- EFS Best Practices
- Join All Desktops and Laptops to a Domain
- Protect Private Keys
- Add More DRAs at Local OU Level
- Use the Trusted for Delegation Option Sparingly
- Back Up Laptops Containing Locally Encrypted Files
- EFS File Handling
- Figuring Out Who Encrypted a File
Back Up Laptops Containing Locally Encrypted Files
EFS is great for making files on a laptop virtually impenetrable to unauthorized access. EFS also makes it more difficult to copy files from the laptop to a server as a backup in case the laptop is lost, stolen, or damaged.
You cannot use Change and Configuration Management features such as Offline Files to make local copies of encrypted files. The files are decrypted before being placed in the local file cache.
Your best option is to use the To File option of NTBACKUP to back up the data on a laptop to a server and then back up the backup file during your nightly tape runs. You can make a script with an icon on the desktop for the user to run the backup, or you can try automating the process with a logoff script. Keep in mind that users often do not log off when they take their laptops off the network. Also, the logoff script will run even when the user is not connected, giving them errors.