Comments on: Does EFS protect network shares? (70-642 certification question)

By: jerod

jerod — Tue, 12 Oct 2010 01:49:56 +0000

Glad I found this. I was very frustrated when I got this question wrong. Now I know I was correct and efs does not protect files over the network.

By: Tony Northrup

Tony Northrup — Sun, 06 Jun 2010 16:58:35 +0000

Doh, you’re right. EFS doesn’t protect against changing system files, which was actually the point of that distractor. As the explanation points out, BitLocker does, EFS does not.

I tricked myself with that question :).

I’m updating the article to avoid future confusion. Thanks for letting me know.

By: John Dangerbrooks

John Dangerbrooks — Sun, 06 Jun 2010 14:52:18 +0000

So, let me re-iterate it clearly. Correct me if I am wrong:

FIRST choice from the TOP: WRONG! The attacker have gained access to an expose console and can read all EFS-encrypted files.

SECOND choice from the TOP: WRONG! To install a keylogger, access to registry (SYSTEM hive) is required. EFS may not protect registry.

THIRD choice from the TOP: CORRECT! EFS-encrypted files are well protect against offline attack. Attack will get nothing but a heap of indecipherable junk!

FOURTH choice from the TOP: WRONG! “EFS only affects files that are accessed on the local computer because Windows automatically decrypts files before sharing them.”