EFSAssistant Wiki & Documentation Rss Feed

UPDATED WIKI: Home

billcan — Wed, 12 Sep 2007 20:55:08 GMT

Welcome to the home of the EFS Assistant (Community Edition)

Update (2007/08/14): We have released a new tool to aid in migrating users to non-self-signed EFS certificates. Have a look here.

Update (2007/05/27): The released version of the Microsoft EFS Assistant is now available! You can find it here.

This site is the home of the the EFS Assistant (Community Edition). The EFS Assistant is a tool that helps organizations centrally manage EFS in order to protect the data on their client PCs. The EFS Assistant is a small tool that installs on a Windows Vista or Windows XP SP2 machine and enforces the company's EFS encryption policy. The policy is configured using Group Policy.

Navigating this Project

Like most open source projects, this is a two-way street - you're welcome to use whatever we've made available here, and we strongly encourage feedback, bug reports, discussion and Patches (code submissions):

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, you can make yourself known to us by posting a reply to the Developers Wanted discussion topic, or you can simply submit a code fix, rewrite or addition via the Upload Patches page.

Project Documentation

UPDATED WIKI: Home

MikeSL — Thu, 16 Aug 2007 15:20:22 GMT

Welcome to the home of the EFS Assistant (Community Edition)

Update (2007/08/14): We have released a new tool to aid in migrating users to non-self-signed EFS certificates. Have a look here.

Update (2007/05/27): The released version of the Microsoft EFS Assistant is now available! You can find it here.

Navigating this Project

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, you can make yourself known to us by posting a reply to the Developers Wanted discussion topic, or you can simply submit a code fix, rewrite or addition via the Upload Patches page.

Project Documentation

UPDATED WIKI: Home

MikeSL — Wed, 27 Jun 2007 14:15:16 GMT

Welcome to the home of the EFS Assistant (Community Edition)

UPDATE (5/27/2007): The released version of the Microsoft EFS Assistant is now available! You can find it here.

Navigating this Project

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, you can make yourself known to us by posting a reply to the Developers Wanted discussion topic, or you can simply submit a code fix, rewrite or addition via the Upload Patches page.

Project Documentation

UPDATED WIKI: Home

billcan — Mon, 11 Jun 2007 20:14:06 GMT

Welcome to the home of the EFS Assistant (Community Edition)

UPDATE (5/27/2007): The released version of the Microsoft EFS Assistant is now available! You can find it here.

How to Participate

We need your help! We want your honest feedback and input to help make this tool as useful as possible for your organization. Here's how you can help:

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, let us know by posting a reply to the Developers Wanted discussion topic.

Project Documentation

UPDATED WIKI: Home

billcan — Sun, 10 Jun 2007 16:58:26 GMT

Welcome to the home of the EFS Assistant

UPDATE (5/27/2007): The released version of the Microsoft EFS Assistant is now available! You can find it here.

How to Participate

We need your help! We want your honest feedback and input to help make this tool as useful as possible for your organization. Here's how you can help:

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, let us know by posting a reply to the Developers Wanted discussion topic.

Project Documentation

UPDATED WIKI: Home

billcan — Thu, 17 May 2007 18:05:42 GMT

Welcome to the home of the EFS Assistant

UPDATE (5/17/2007): Release Candidate 3 is now available! This release includes updates to both the EFS Assistant tool and the full Administrator's Guide.

This site is where the Microsoft Data Encryption Toolkit for Mobile PCs team is developing the Microsoft EFS Assistant. The EFS Assistant is a tool that helps organizations centrally manage EFS in order to protect the data on their client PCs. The EFS Assistant is a small tool that installs on a Windows Vista or Windows XP SP2 machine and enforces the company's EFS encryption policy. The policy is configured using Group Policy.

How to Participate

We need your help! We want your honest feedback and input to help make this tool as useful as possible for your organization. Here's how you can help:

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, let us know by posting a reply to the Developers Wanted discussion topic.

Data Encryption Toolkit for Mobile PCs

The EFS Assistant is part of the Data Encryption Toolkit for Mobile PCs (DET). This toolkit is intended to help organizations understand the risks inherent in their mobile PCs, choose a Microsoft technology or technologies that can help address their risks, and deploy those technologies in a way that is supportable in a large organization. Parts of the DET are currently available. See http://www.microsoft.com/det for more information.

Project Documentation

UPDATED WIKI: Home

billcan — Thu, 17 May 2007 18:05:30 GMT

Welcome to the home of the EFS Assistant

UPDATE (5/4/2007): Release Candidate 3 is now available! This release includes updates to both the EFS Assistant tool and the full Administrator's Guide.

How to Participate

We need your help! We want your honest feedback and input to help make this tool as useful as possible for your organization. Here's how you can help:

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, let us know by posting a reply to the Developers Wanted discussion topic.

Data Encryption Toolkit for Mobile PCs

Project Documentation

UPDATED WIKI: Home

billcan — Sat, 12 May 2007 06:37:18 GMT

Welcome to the home of the EFS Assistant

UPDATE (5/4/2007): Release Candidate 2 is now available! This release includes updates to both the EFS Assistant tool and the full Administrator's Guide. This one could be it!

How to Participate

We need your help! We want your honest feedback and input to help make this tool as useful as possible for your organization. Here's how you can help:

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, let us know by posting a reply to the Developers Wanted discussion topic.

Data Encryption Toolkit for Mobile PCs

Project Documentation

UPDATED WIKI: EFS Assistant Design

billcan — Fri, 11 May 2007 17:56:53 GMT

NOTE: This is not the design specification for the tool. It will be eventually, but right now it is a holding place for things that we know we need to cover in the spec. The actual design spec is a Word file the team is maintaining outside Codeplex.

We will rectify this situation in the future, but right now please bear with us...

Reporting

The following information will be stored in the WMI database by the tool:

Name - Full pathname of the file/folder
FolderClassification - Contains the folder classification the tool made:

Green - The folder should be encrypted
Yellow - Unable to determine if the folder should be encrypted
Red - The folder should not be encrypted
N/A - The entry is a file, so not applicable

SourceOfClassification - Gives the reason why the folder/file was encrypted:

System Folder
Not able to classify (for all yellow folders)
FileCategorization
EncryptByFiles
Inherited Green
Inherited Red
More (please list)

EncryptionStatus - Indicates whether the file/folder was or was not encrypted:

0 - indicates the file/folder was not successfully encrypted
1 - indicates the file/folder was encrypted

EncryptionSubStatus - When something is not encrypted, this gives the reason. Possible reasons include:

Error occured
Compressed folder when autodecompress is not specified
Shared folder when encrypt shared folders is not specified
Etc. (Please enumerate)

Tick - number of ticks on the system when the file was acted upon

MORE INFO:

Make note of this: We special-purpose the case of Junction points. We do not add them to any of the lists, but we check for them and will not scan into them. We also classfiy them as Red in WMI.

We should try to preserve last modified dates on files and folders. We do this successfully on files, but on folders the last modified date is only preserved if the folder is empty. This is because we set the set the encrypt bit and reset the last modified date before we start encrypting the files in the folder. When a new file is encrypted, it means the directory is modified, thus resetting the date.

!Flowcharts (more documentation coming)

UPDATED WIKI: Home

billcan — Fri, 04 May 2007 19:32:51 GMT

Welcome to the home of the EFS Assistant

UPDATE (5/4/2007): Release Candidate 1 now available! This release includes both the EFS Assistant tool and the full Administrator's Guide.

How to Participate

We need your help! We want your honest feedback and input to help make this tool as useful as possible for your organization. Here's how you can help:

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, let us know by posting a reply to the Developers Wanted discussion topic.

Data Encryption Toolkit for Mobile PCs

Project Documentation

UPDATED WIKI: Home

billcan — Thu, 03 May 2007 22:19:58 GMT

Welcome to the home of the EFS Assistant

UPDATE (5/3/2007): Build 1.0.156.14 is currently available. The RC1 release has been temporarily removed. We will restore it as soon as possible.

How to Participate

We need your help! We want your honest feedback and input to help make this tool as useful as possible for your organization. Here's how you can help:

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, let us know by posting a reply to the Developers Wanted discussion topic.

Data Encryption Toolkit for Mobile PCs

Project Documentation

UPDATED WIKI: Mini-Evaluator's Guide

billcan — Thu, 03 May 2007 20:33:09 GMT

Evaluator's Guide

NOTE: This Guide is out of date. Do not use.

This page is here for historical purposes only. You may get the full EFS Assistant Administrator's Guide by downloading from the Releases tab.

Introduction

The EFS Assistant is a tool that helps administrator's use EFS to enforce an appropriate encryption policy on their client computers. It is a small application that is installed and run on your client computers that receives its configuration via group policy (generally distributed by Active Directory). Depending on how you configure the tool, the EFS Assistant will cause various files and folders on the system to be encrypted using Microsoft's Encrypting File System (EFS). The EFS Assistant is intended to be run periodically on your organization's client computers to ensure that confidential data files get and stay encrypted.

This Mini-Evaluator's Guide is intended to get an idea of how you can evaluate whether the EFS Assistant would be appropriate for your organization. This guide will help you understand how to:

Install the tool
Run the tool
Review the results
Update the Configuration
Uninstall

Read This Section First!

The EFS Assistant does its best to avoid messing up your system, but you should know a few things before your run it:

The EFS Assistant is primarily designed to run on single user systems. If your system is used by more than one user regularly, there is a chance that other user's files might get encrypted. You should exercise caution when running the tool on a multiple-user system.
Support for folders configured to roam as part of a roaming user profile is limited at best. While there is a configuration setting to support encryption of these files, this capability is not working and should not be used. It is likely that this feature will be removed before release.
The EFS Assistant configures EFS to encrypt files. Some anti-virus or backup tools may have issues dealing with EFS-encrypted files. For instance, there is a known issue with EFS and Symantec anti-virus on Vista machines. Before running the tool, please back up critical files. It is also a good idea to do a controlled test of EFS on your system prior to running the EFS Assistant.
The tool can run in reporting mode. If you are concerned about actually encrypting your files, but want to see what the tool would do if you ran it, configure the tool to run in Reporting Only mode (see below).
There is a limitation in Excel 2003 and earlier that prevents it from displaying more than 65536 rows in a spreadsheet. If you have a machine with more files/folders than this, the report displayed in these versions of Excel will not be complete. Excel 2007 does not have this problem.

Installing the tool

The following section describes installation of the tool.

The tool can be installed in two ways: interactively and in background mode. We recommend that evaluators install the tool in interactive mode. To install, simply double-click the EFSAssistant.msi file.

After you have accepted the license, etc., you will have the opportunity to install 5 features. We recommend installing all 5. The description of each feature in the installer should provide enough information to undertand the purpose of each feature. For more detailed information, see the Installer Design document.

Running the tool

When you install the "Evaluation Settings" feature, the tool is automatically configured to encrypt specified folders and perform file categorization. "Encrypt specified folders" means that the tool will encrypt certain folders that Microsoft has determined should be encrypted (for example, My Documents, etc.). More folders can easily be added to this list using the Group Policy editor (see below). "File categorization" means that the tool will review the contents of all folders and encrypt the folder and its contents if the folder contains only Word, Excel, or Powerpoint files. Note that types of files that will cause file categorization to succeed can be modified by the adminstrator (see below).

You can run the tool by choosing it from the start menu (under Microsoft EFS Assistant). The tool will notify you that it has started with balloon in the system tray. When it has finished it will display another balloon.

Reviewing the results

Once the tool has run, you can review the results by running the "EFS Assistant Results Viewer". This VBScript pulls the results of the encryption run out of WMI and sends it to a CSV file. This file will be created in your My Documents folder. Next, the script starts Excel and allows you to view the file in a easy to read manner. Note that older versions of Excel (prior to 2007) will only display the first 65536 lines of the CSV file.

You can also see what files are encrypted by using Windows Explorer. Folders and files that have their names in green are ones that have been encrypted. (If you don't see any green folders, go to Tools->Folder Options in the Explorer window and make sure that "Snow encrypted or compressed NTFS folders in color" is selected under the View tab.)

Updating the Configuration

If you are happy with the results of the encryption run, you can stop here and move straight to planning for a pilot deployment. On the other hand, you may want to make some changes to the configuration. To do so, you must use the Group Policy editor to edit the local group policy on your machine.

You can start the Group Policy editor by typing "gpedit.msc" in the Run... dialog box and hitting enter. Under Computer Configuration then Administrative Settings you will find the configuration options for the EFS Assistant. Some settings you might want to modify are:

Reporting mode - Enabling will only tell you what the tool would do, but will not actually cause any files to be encrypted.
Folders to encrypt - This is a list of folders that the tool will always encrypt. Note that any folder specified in this list will include all its subfolders, unless that subfolder is on the list of folders not to encrypt.
Folders not to encrypt - This is a list of folders that the tool will never encrypt. Like the previous configuration setting, an subfolders of the folders on this list will also not be encrypted, unless that folder is on the list of folders to encrypt.
File types to encrypt - This is a list of file extensions that should be considered as encryptable files. These settings should be entered as file extensions including the period (for example, ".ppt"). This list is used in two ways:

When the tool does file categorization (see below), this is the list of file types that are considered data files.
When the tool is configured to encrypt individual files, any files with these extensions in uncategorized folders will be encrypted. See below for further information.

Encrypt individual files - When this setting is set, data files in uncategorized folders will be encrypted individually.

One thing you should be aware of: when you install the "Evaluation Settings", you will be writing certain configuration settings to the area of the registry that is used by Group Policy. However, we do not set these settings through the local group policy itself. This means that even though the Group Policy editor does not show it, certain configuration options are set. These options are:

Folder Encryption Mode - set to encrypt specified folders and perform file categorization (see below)
Debugging Mode - Set to enabled
File types to encrypt - set to contain ".ppt, pptx, .doc, .docx, .xls, .xlsx"

Key Concepts

Folder classification

Folders can be classified as either Green, Yellow, or Red, although Yellow is actually just a shorthand of "unclassifiable". These classifications have the following meaning:

Green - A folder classified as green should be encrypted. Folders can be green for a number of reasons, such as the user specified the folder on the "Folders to encrypt" list.
Red - A folder classified as red should not be encrypted. Folders can be red for a number of reasons, for example, they might contain critical Windows files.
Yellow - A folder is classified as Yellow when the tool cannot figure out if it Red or Green. For example, if the user creates a random folder called "C:\DataFiles", this would most likely be classified as a yellow folder because the administrator probably did not know this folder exist until he reviewed the log.

The tool knows what to do with green folders: encrypt them. The tool also knows what to do with red folders: leave them alone. The problem is what to do with yellow folders. The tool has two primary ways of dealing with these folders, described below.

File Categorization

File categorization is one way the tool tries to handle folders that the administrator did not know about when he set the configuration (that is, that are not on either the 'Folders to encrypt list' or the 'Folders not to encrypt' list.

When doing file categorization, when the tool finds a folder that it does not have on either of its two lists, the tool will look at the files inside that folder and make a decision. If the folder contains only data files (that is, files that listed in the 'File types to encrypt' list), the tool will encrypt the folder and all the files in it. (Note that the tool will not encrypt subfolders of this folder.)

If the folder contains any files that are not considered data files, the tool will leave the folder alone (and unencrypted).

Encrypting individual files

If file categorization does not meet your needs, you can also tell the tool to encrypt individual files. This setting can work either instead of, or in addition to, file categorization. If 'Encrypt individual files' is set, the tool will encrypt all files of the types specified in 'File types to encrypt' that occur in unclassified folders. Generally speaking, if you set this setting and adequately enumerate your data file types, you can encrypt the vast majority of the data files on your organizations laptops.

Typical Configurations

You might want to try out one or more of the following typical configurations for EFS Assistant. Some typical configurations are:

Encrypt only specified folders (minimal encryption)

This is the most conservative encryption mode. To configure this mode, configure the following settings:

Configuration Option	Setting	Impact
Folder encryption mode	Specified folders only	Only encrypt specific folders, do not do file categorization
Folders to encrypt	Folder paths that you want encrypted	Only these folders will be encrypted
Folders not to encrypt	Folder paths that you want to leave unencrypted	In this mode, these are exceptions to the folders to encrypt list above. Since folders inherit, if you tell the tool to encrypt c:\data it will encrypt everything under that folder. If you want to leave c:\data\program unencrypted, add it to this list.

Encrypt specified folders and folders with data files (conservative encryption)

This is the default configuration mode and is fairly conservative. In this mode, the tool will encrypt the folders you tell it to (not including the folders you tell it not to, of course). In addition, it will scan for folders that only contain data files and encrypt those as well.

To configure this mode, configure the following settings:

Configuration Option	Setting	Impact
Folder encryption mode	Specified folders and file categorization	Encrypt specific folders and do file categorization (encrypt any folder that only contains data files)
Folders to encrypt	Folder paths that you want encrypted	Only these folders will be encrypted
Folders not to encrypt	Folder paths that you want to leave unencrypted	In this mode, these are exceptions to the folders to encrypt list above. Since folders inherit, if you tell the tool to encrypt c:\data it will encrypt everything under that folder. If you want to leave c:\data\program unencrypted, add it to this list.
File types to encrypt	List of file extensions (including the period) that should be considered data files	These file types will be considered as data files for the purposes of file categorization

Encrypt specified folders, folders with data files, and all data files in unencrypted folders (aggressive encryption)

This is a fairly aggressive encryption mode. In this mode, the tool will encrypt the folders you tell it to (not including the folders you tell it not to, of course). In addition, it will scan for folders that only contain data files and encrypt those as well. Finally, whenever if finds a data file in an uncategorized (yellow) folder, it encrypts the data file itself.

To configure this mode, configure the following settings:

Configuration Option	Setting	Impact
Folder encryption mode	Specified folders and file categorization	Encrypt specific folders and do file categorization (encrypt any folder that only contains data files)
Folders to encrypt	Folder paths that you want encrypted	Only these folders will be encrypted
Folders not to encrypt	Folder paths that you want to leave unencrypted	In this mode, these are exceptions to the folders to encrypt list above. Since folders inherit, if you tell the tool to encrypt c:\data it will encrypt everything under that folder. If you want to leave c:\data\program unencrypted, add it to this list.
File types to encrypt	List of file extensions (including the period) that should be considered data files	These file types will be considered as data files for the purposes of file categorization and for encrypting data files
Encrypt individual files	Enabled	Causes all data files on the disk to be encrypted unless they are in a red folder

Encrypt almost everything (very aggressive encryption)

This is the most aggressive encryption mode. This mode tells the EFS Assistant to encrypt every folder and its contents unless it is specifically instructed not to. Basically, the tool only honors its internal list of folders not to encrypt as well as the folders you specify on the "Folders not to encrypt" list. Everything else will be encrypted. NOTE: This mode should be used with extreme caution. It could encrypt something that should not be encrypted.

To configure this mode, configure the following settings:

Configuration Option	Setting	Impact
Folder encryption mode	Maximize encryption	Encrypt any file not on the red list
Folders not to encrypt	Folder paths that you want to leave unencrypted	Any folder on this list (and its subfolders) will not be encrypted.

Uninstalling

When you are done testing, you can uninstall the tool. Uninstalling will remove:

the tool
the administrative templates
the evaluation setting registry changes
the Start menu shortcuts
The reporting tool

In addition, you should be aware that when you uninstall, you will effectively remove the logging data stored in WMI. However, any files you saved from the reporting tool will still be available.

NOTE: Removing the tool does not decrypt any files. If you wish to reverse all encryption performed by the EFS Assistant, you can use the CIPHER.EXE utility on each drive on which EFS encryption was performed. For example, to decrypt all the files on your C: drive, use the command "CIPHER.EXE /d /a /s:C:\" from a command prompt. As long as you close all your applications before running this command, CIPHER will be able to gain exclusive access to all folders and files to decrypt them. Note that if you had previously encrypted any files using EFS, the CIPHER tool will decrypt those files also.

UPDATED WIKI: Home

billcan — Thu, 03 May 2007 20:30:59 GMT

Welcome to the home of the EFS Assistant

UPDATE (4/24/2007): Release Candidate 1 now available! This release includes both the EFS Assistant tool and the full Administrator's Guide.

How to Participate

We need your help! We want your honest feedback and input to help make this tool as useful as possible for your organization. Here's how you can help:

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, let us know by posting a reply to the Developers Wanted discussion topic.

Data Encryption Toolkit for Mobile PCs

Project Documentation

UPDATED WIKI: Home

billcan — Thu, 03 May 2007 20:29:38 GMT

Welcome to the home of the EFS Assistant

UPDATE (4/24/2007): Release Candidate 1 now available. See Release Candidate 1.

How to Participate

We need your help! We want your honest feedback and input to help make this tool as useful as possible for your organization. Here's how you can help:

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, let us know by posting a reply to the Developers Wanted discussion topic.

Data Encryption Toolkit for Mobile PCs

Project Documentation

UPDATED WIKI: Mini-Evaluator's Guide

billcan — Sun, 29 Apr 2007 17:47:09 GMT

Evaluator's Guide

NOTE: Updated version now available

This Evaluator's Guide is the first chapter of the EFS Assistant Administrator's Guide. We have taken an excerpt of this guide and added to the our release package (see Build 1.0.156.14). For the most up to date version of this guide, please see that version. Eventually, this Evaluator's Guide page will be retired.

Introduction

Install the tool
Run the tool
Review the results
Update the Configuration
Uninstall

Read This Section First!

The EFS Assistant does its best to avoid messing up your system, but you should know a few things before your run it:

The EFS Assistant is primarily designed to run on single user systems. If your system is used by more than one user regularly, there is a chance that other user's files might get encrypted. You should exercise caution when running the tool on a multiple-user system.
Support for folders configured to roam as part of a roaming user profile is limited at best. While there is a configuration setting to support encryption of these files, this capability is not working and should not be used. It is likely that this feature will be removed before release.
The EFS Assistant configures EFS to encrypt files. Some anti-virus or backup tools may have issues dealing with EFS-encrypted files. For instance, there is a known issue with EFS and Symantec anti-virus on Vista machines. Before running the tool, please back up critical files. It is also a good idea to do a controlled test of EFS on your system prior to running the EFS Assistant.
The tool can run in reporting mode. If you are concerned about actually encrypting your files, but want to see what the tool would do if you ran it, configure the tool to run in Reporting Only mode (see below).
There is a limitation in Excel 2003 and earlier that prevents it from displaying more than 65536 rows in a spreadsheet. If you have a machine with more files/folders than this, the report displayed in these versions of Excel will not be complete. Excel 2007 does not have this problem.

Installing the tool

Running the tool

Reviewing the results

Updating the Configuration

Reporting mode - Enabling will only tell you what the tool would do, but will not actually cause any files to be encrypted.
Folders to encrypt - This is a list of folders that the tool will always encrypt. Note that any folder specified in this list will include all its subfolders, unless that subfolder is on the list of folders not to encrypt.
Folders not to encrypt - This is a list of folders that the tool will never encrypt. Like the previous configuration setting, an subfolders of the folders on this list will also not be encrypted, unless that folder is on the list of folders to encrypt.
File types to encrypt - This is a list of file extensions that should be considered as encryptable files. These settings should be entered as file extensions including the period (for example, ".ppt"). This list is used in two ways:

When the tool does file categorization (see below), this is the list of file types that are considered data files.
When the tool is configured to encrypt individual files, any files with these extensions in uncategorized folders will be encrypted. See below for further information.

Encrypt individual files - When this setting is set, data files in uncategorized folders will be encrypted individually.

Folder Encryption Mode - set to encrypt specified folders and perform file categorization (see below)
Debugging Mode - Set to enabled
File types to encrypt - set to contain ".ppt, pptx, .doc, .docx, .xls, .xlsx"

Key Concepts

Folder classification

Folders can be classified as either Green, Yellow, or Red, although Yellow is actually just a shorthand of "unclassifiable". These classifications have the following meaning:

Green - A folder classified as green should be encrypted. Folders can be green for a number of reasons, such as the user specified the folder on the "Folders to encrypt" list.
Red - A folder classified as red should not be encrypted. Folders can be red for a number of reasons, for example, they might contain critical Windows files.
Yellow - A folder is classified as Yellow when the tool cannot figure out if it Red or Green. For example, if the user creates a random folder called "C:\DataFiles", this would most likely be classified as a yellow folder because the administrator probably did not know this folder exist until he reviewed the log.

File Categorization

Encrypting individual files

Typical Configurations

You might want to try out one or more of the following typical configurations for EFS Assistant. Some typical configurations are:

Encrypt only specified folders (minimal encryption)

This is the most conservative encryption mode. To configure this mode, configure the following settings:

Configuration Option	Setting	Impact
Folder encryption mode	Specified folders only	Only encrypt specific folders, do not do file categorization
Folders to encrypt	Folder paths that you want encrypted	Only these folders will be encrypted
Folders not to encrypt	Folder paths that you want to leave unencrypted	In this mode, these are exceptions to the folders to encrypt list above. Since folders inherit, if you tell the tool to encrypt c:\data it will encrypt everything under that folder. If you want to leave c:\data\program unencrypted, add it to this list.

Encrypt specified folders and folders with data files (conservative encryption)

Configuration Option	Setting	Impact
Folder encryption mode	Specified folders and file categorization	Encrypt specific folders and do file categorization (encrypt any folder that only contains data files)
Folders to encrypt	Folder paths that you want encrypted	Only these folders will be encrypted
Folders not to encrypt	Folder paths that you want to leave unencrypted	In this mode, these are exceptions to the folders to encrypt list above. Since folders inherit, if you tell the tool to encrypt c:\data it will encrypt everything under that folder. If you want to leave c:\data\program unencrypted, add it to this list.
File types to encrypt	List of file extensions (including the period) that should be considered data files	These file types will be considered as data files for the purposes of file categorization

Encrypt specified folders, folders with data files, and all data files in unencrypted folders (aggressive encryption)

Configuration Option	Setting	Impact
Folder encryption mode	Specified folders and file categorization	Encrypt specific folders and do file categorization (encrypt any folder that only contains data files)
Folders to encrypt	Folder paths that you want encrypted	Only these folders will be encrypted
Folders not to encrypt	Folder paths that you want to leave unencrypted	In this mode, these are exceptions to the folders to encrypt list above. Since folders inherit, if you tell the tool to encrypt c:\data it will encrypt everything under that folder. If you want to leave c:\data\program unencrypted, add it to this list.
File types to encrypt	List of file extensions (including the period) that should be considered data files	These file types will be considered as data files for the purposes of file categorization and for encrypting data files
Encrypt individual files	Enabled	Causes all data files on the disk to be encrypted unless they are in a red folder

Encrypt almost everything (very aggressive encryption)

Configuration Option	Setting	Impact
Folder encryption mode	Maximize encryption	Encrypt any file not on the red list
Folders not to encrypt	Folder paths that you want to leave unencrypted	Any folder on this list (and its subfolders) will not be encrypted.

Uninstalling

When you are done testing, you can uninstall the tool. Uninstalling will remove:

the tool
the administrative templates
the evaluation setting registry changes
the Start menu shortcuts
The reporting tool

UPDATED WIKI: Installer Design

billcan — Sun, 29 Apr 2007 02:25:58 GMT

Installer Design

Overview

The installer is the first component of the EFS Assistant that a user will experience, so it should work in a very intuitive manner for an administrator evaluating the tool for the first time. That said, we also want to be able to use the same installer to install the tool to thousands of mobile PCs when the administrator is ready to deploy, so the installer must be able to install the bare minimum components when the installer is running in an SMS or Group Policy environment. We have designed the tool to operate effectively in both situations.

This document describes how the EFS Assistant installer (EFSAssistant.msi) should function.

Preinstallation Checks

The installer should check the following items before it installs:

Is the install occuring on a Windows XP SP2 or Windows Vista system
Is .NET Framework v1.1 or v2.0 installed
Is the installer running as an administrative user

If any of these checks fail, the installer should display an error message and halt.

Feature List

There are five features that the installer can install. These features are:

EFS Assistant Tool

Installing this feature will put the EFSAssistant.exe and related DLLs in the installation folder (default location is %ProgramFiles%\Microsoft EFS Assistant). It will also perform install the EFSAssistant MOF file to modify the WMI configuration.

Reporting Tool

Installing this feature will put the EFSAWMI.vbs script file in the installation directory. See the Reporting Tool Design for more information about this tool.

Administrative Templates

Installing this feature will put the appropriate administrative templates on the system. What happens depends on which operating system is running:

On a Windows Vista system, the EFSAssistant.admx file is copied to the %Windir%\PolicyDefinitions folder, and the EFSAssistant.adml file is copied to the %Windir%\PolicyDefinitions\en-us folder.
On a Windows XP system, the EFSAssistant.adm file is copied to the %Windir\system32\GroupPolicy\adm folder.

Evaluation Settings

When this feature is installed, a few default settings are configured for the tool. Specifically, the following registry settings are set:

Registry Key	Value	Purpose
HKLM\Software\Policies\Microsoft\EFS Assistant\FolderEncryptionMode	1	Encrypt specified folders and perform file categorization
HKLM\Software\Policies\Microsoft\EFS Assistant\DebugEnabled	1	Turn on debug logging
HKLM\Software\Policies\Microsoft\EFS Assistant\DisplayBalloons	1	Turn on status balloons
HKLM\Software\Policies\Microsoft\EFS Assistant\FileExtensionsToEncrypt	.doc, .docx, .ppt, .pptx, .xls, .xlsx	Sample list of file extensions that will cause file categorization

NOTE: These settings may be overwritten when the administrator uses the group policy editor to change the tool's configuration.

Shortcuts

Installing this feature creates a folder in the start menu called "Microsoft EFS Assistant" and places shortcuts in it. This feature will install shortcuts to the following two files:

EFSAssistant.exe - The EFS Assistant Tool
EFSAWMI.vbs - The EFS Assistant Results Viewer

Note that it will only install shortcuts for files that were installed.

Installation Modes

As stated before, we need to be able to handle two scenarios:

Administrator installing the tool on a computer for testing and evaluation
Administrator pushing the installer to the computers in his environment for pilot or production deployment

To support both scenarios, the installer operates differently in interactive and non-interactive modes. These are described below:

Interactive

Interactive mode is the default installation mode. The installer runs in this mode if you double-click on the MSI file itself or if you start the installer with the command 'msiexec -i EFSAssistant.msi /qf'. This mode displays the EULA then allows the user to choose features to be installed. By default, all features listed above will be installed.

Non-interactive

The installer can also run in less than full interactive mode (for example when run with the command 'msiexec -x EFSAssistant.msi /qn'). In this mode, by default, only the EFS Assistant Tool feature will be installed.

If the administrator wants to install other features in non-interactive mode, he can do so using command line options. The options are:

Feature	Command Line Option to Install	Default Non-interactive Behavior	Default Interactive Behavior
EFS Assistant Tool	N/A (Always installed)	Install	Install
Reporting Tool	REPORT=1	Do not install	Install
Administrative Templates	TEMPLATES=1	Do not install	Install
Evaluation Settings	SETTINGS=1	Do not install	Install
Shortcut	SHORTCUTS=1	Do not install	Install

To install in background mode, the command is:

msiexec /qn -i EFSAssistant.msi [option(s)]

For example, to install the EFS Assistant, the reporting tool, and the program shortcuts, use the following command:

msiexec /qn -i EFSAssistant.msi REPORT=1 SHORTCUTS=1

Note: You may, but do not have to, set an option to '0' to turn it off. For example, you can install the tool and the shortcuts but no reporting tool with the following command:

msiexec /qn -i EFSAssistant.msi REPORT=0 SHORTCUTS=1

Uninstalling

The tool will remove everything when uninstalling in either interactive or non-interactive mode. This includes:

Removing executables and DLLs
Removing the reporting tool
Removing the installation directory
Removing the default registry settings
Removing the WMI extensions
Removing the Start menu shortcuts

Note that the uninstaller will not clean up any debug logs, CSV files generated by the reporting tool, or group policy changes that you may have made.

UPDATED WIKI: Home

billcan — Wed, 25 Apr 2007 17:44:36 GMT

Welcome to the home of the EFS Assistant

UPDATE (4/24/2007): New version released (including an updated Evaluator's Guide)! See Build 1.0.156.14.

How to Participate

We need your help! We want your honest feedback and input to help make this tool as useful as possible for your organization. Here's how you can help:

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, let us know by posting a reply to the Developers Wanted discussion topic.

Data Encryption Toolkit for Mobile PCs

Project Documentation

UPDATED WIKI: Home

billcan — Wed, 25 Apr 2007 03:55:47 GMT

Welcome to the home of the EFS Assistant

UPDATE (4/24/2007): New version released. See Build 1.0.156.0.

How to Participate

We need your help! We want your honest feedback and input to help make this tool as useful as possible for your organization. Here's how you can help:

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, let us know by posting a reply to the Developers Wanted discussion topic.

Data Encryption Toolkit for Mobile PCs

Project Documentation

UPDATED WIKI: Functional Specification

billcan — Tue, 24 Apr 2007 21:19:04 GMT

Scenarios

Organizational Archetype

For the purposes of these requirements, we are using the fictional Woodgrove National Bank as our organizational archetype. Woodgrove National Bank is a leading global investment bank that serves institutional, corporate, government and individual clients in its role as a financial intermediary. Its business includes securities underwriting, sales and trading, financial advisory services, investment research, venture capital, and brokerage services for financial institutions. Woodgrove employs more than 15,000 people in 60 offices worldwide. Enterprise headquarters for Woodgrove is located in New York.

Personas

The scenarios for the EFS Assistant will use the following fictional employees of Woodgrove National Bank:

Persona	Role	Description
Nicolas Velez	Financial Analyst, Knowledge Worker	Nicolas works in finance. His only computer is a brand new ThinkPad laptop running Windows Vista. Because of Nicolas’ specific job function, he is often on the road and stores many different types of confidential data on his laptop. In addition, he often needs to install unique financial analysis tools on his laptop computer.
Quentin Kelly	HR Manager, Knowledge Worker	Quentin works in human resources. He uses a 1 year old Toshiba laptop running Windows XP. Because of Quentin's specific job function, he has lots of personal information on his laptop at all times. He does not travel much, but does use his laptop to extend his work day into the evenings.
Meg Collins	Desktop/Laptop System Administrator	Meg is responsible for managing desktop computers across the organization and defining the deployment process for service packs and updates to these computers. She is involved in setting the strategic direction for the desktop OS, applications, and hardware. Meg is the escalation point for Desktop Support.
Diane Meyers	Operations Analyst	Diane monitors enterprise systems, but does no end user support. While Diane is responsible for network monitoring, several of her peers are responsible for monitoring servers and services.
Kevin Parrish	Security Specialist	Kevin is responsible for determining and implementing server security policy and evaluating new technology.
Phil Otten	Help Desk Support	Phil is a member of the Help Desk team that is the first line of support for requestors. He responds to calls concerning network, desktop, and application problems. He addresses logon problems, password resets, and most issues with desktop applications, and typically handles 50+ calls each day.

Scenarios

Following are the scenarios for the EFS Assistant tool. Each scenario will list the personas involved in the scenario, a narrative describing the scenario itself, and the requirements that are driven by the scenario.

SCEN-010: Evaluate the EFS Assistant

Persona:

Meg Collins

Scenario:

Meg has heard about the EFS Assistant from Kevin Parrish, the Security Analyst at Woodgrove Bank. She would like to evaluate whether or not this tool would help her ensure encryption of data on her company's laptops. Therefore, she downloads the EFS Assistant package which includes the tool, some documentation, and various other support files. She looks at the documentation a bit and sees that the first chapter is an evaluator's guide that explains how she can determine if this tool is appropriate for her organization. She reads this section, has a quick glance through the rest of the document and decides to install the tool.

First, Meg double clicks the installer package. She is given several options: install the tool itself, install the administrative templates, create a start menu icon, etc.. Because she has read the evaluator's guide, she decides to accept the defaults and install everything. Because Meg has run the installer interactively, the installer configures appropriate defaults for an evaluator.

Because the installer configured the tool for evaluation mode, Meg could run the tool without configuration and it would encrypt many of the folders on her test system. However, Meg is the cautious sort, and decides that she would like to run the tool in reporting mode to see what it would encrypt before actually encrypting anything. Therefore, she consults the administrator's guide and learns how to configure this mode. She uses the administrative interface to change the configuration on her test system to reporting only mode, then runs the tool.

When she's done, she uses the accompanying reporting tool to understand what folders and files the tool would have encrypted. She is satisfied that the tool will not cause any issues, so she recongifures the tool to run in encryption mode and then starts the tool again my selecting it from the start menu. She goes away to get a cup of coffee while the tool runs.

When she returns, she notices that the tool has completed its run. She uses the reporting tool to see what the tool did and is satisfied that it encrypted appropriate folders and files. After a few more rounds of increasingly restrictive modifications to the configuration of the tool, she becomes convinced that the tool has the capabilities that she requires and decides that it will meet the needs of her production users.

SCEN-020: Install the EFS Assistant into the production environment for a pilot group of users

Personas:

Meg Collins, Nicolas Velez, Kevin Parrish

Scenario:

Meg decides that the EFS Assistant will work in her environment, and decides to deploy it to a pilot group of users. She uses the administrative interface to configure the tool for the pilot users. Next, she uses her company's software deployment tool to push the installer to the selected laptops in the pilot group and install the tool. She chooses to have the tool run on every authentication and uses her company's client management system to make that change.

Nicolas Velez is a member of the pilot group of users. Meg informed him that he would see some changes on his system via an email that he received the prior week. The email also explained why this was happening and what to do if he notices something unusual.

Nicolas logs in the first morning after the software has been installed on his system. Unbeknownst to Nicolas, the tool starts up upon his authentication. Unfortunately, because of a glitch in the software distribution tool, the tool was installed on Nicolas' system, but the configuration settings were not. In order to prevent the tool from doing something unexpected, the tool exits immediately.

By the next day, the configuration for the tool has reached Nicholas' laptop. As before, when he logs in the tool starts. This time, the tool finds its configuration and begins running as configured. Meg has configured the tool to only encrypt specified folders (i.e., minimal encryption mode). Nicholas does not see anything on his screen that tells him the tool is running, but he does notice that the hard drive access light is glowing steadily. He starts up Outlook and Word and goes about his business. He does not notice that his system is running slower because of the tool.

Thirty minutes later, Nicholas undocks his laptop and goes to a meeting. While Nicholas does not know it, the tool has stopped scanning his disks in order to avoid draining his battery while he does not have AC power. When he gets back to his desk and redocks his laptop, the tool will start running again.

The tool finishes its run on Nicholas' machine. Nicholas notices that certain folders and files are now colored green. He remembers that the communication he received from Meg told him to expect this, and that this means these files are now protected in case his laptop is lost or stolen.

A week later, Meg decides she would like to see how the pilot users are getting along as well as how well the minimal encryption configuration is working for these users. She uses SMS to pull information off the pilot laptops then analyzes the data. She realizes that all but one of the pilot users have a folder that she feels should be encrypted but is not. After consulting with Kevin Parrish, Woodgrove's security specialist, she decides this folder does indeed need to be encrypted. She updates the configuration with the administrative tool, waits a few days and rechecks. She sees that the folder is now being encrypted on all machines.

SCEN-030: Getting more aggressive with encryption

Personas:

Meg Collins, Nicolas Velez, Kevin Parrish

Scenario:

Meg starts to think of other ways to make the tool encrypt more sensitive data on her laptops. Again, she talks to Kevin and discusses a situation she is seeing on some of the pilot laptops. Some users are creating folders in locations that she does not know about beforehand, such as under C:\. She wants to make sure that confidential data stored in such folders is encrypted, but can't know ahead of time where those folders will be. She remembers from the documentation that the tool has the ability to help address this situation: it can be configured to find folders containing data files and encrypt those folders.

Meg decides to try out this capability on her pilot users. After talking to Kevin, she finds out the types of data file types the organization uses and configures them into the administrative tool. In addition, she configures the tool to encrypt folders containing these files. She waits to see how this works out for the pilot users. A few days later, she pulls the reports for encryption on her pilot users' machines and finds that, indeed, she has found and encrypted a number of new folders on each user's machine. She is pleased.

Kevin Parrish meets with Meg and discusses the success they are having with the pilot for the EFS Assistant. Kevin mentions that it a new corporate policy has been established that requires all data files on mobile PCs must be encrypted no matter where they are. Meg is ready for this request. She tells Kevin that the EFS Assistant can help enforce this policy. Kevin asks her to make it happen and report back.

Meg goes to the administrative interface and configures the tool to encrypt all data files no matter where they are found. The configuration is applied to the pilot laptops, and the next time the tool runs, these files are encrypted as instructed. Again, Meg waits a few days, then checks the reports for these pilot systems. She is pleased to see that many additional data files are encrypted on the pilot systems, and that still no one has called her to complain about broken applications or other unusual behavior.

Meg is starting to wonder just how far she can push the encryption on her pilot systems. She decides to ask for volunteers from the pilot group for people who would help her conduct an experiment. She knows that the EFS Assistant can be configured to encrypt just about everything on the hard drive except for folders that are specifically configured not to be encrypted. She feels she can do this because in her environment, everyone has his/her own laptop.

She uses the administrative tool to set up a new policy for the volunteer group. After a few days she checks the reports and sees that, indeed, all but the a small number of folders are being encrypted. In the folder that are not encrypted, all data files are encrypted individually. She estimates that she is encrypting nearly 100% of all the data on the pilot laptops, and about 80% of all the folders on the systems.

She is very pleased with the results until she gets a call from Nicolas. Nicolas has an application that has stopped working. After a bit of research, she determines that there is a folder that must be accessed by a system process that should not be encrypted. Unfortunately, the EFS Assistant has encrypted this folder. The good news for Meg is that the EFS Assistant can handle this situation. She uses the administrative interface to add the problem folder to the list of folders that should not be encrypted. This will prevent the folder from being encrypted again. She tells Nicolas how to decrypt this folder by hand and informs him that he can also wait until the EFS Assistant runs again at which time it will decrypt the problem folder. Nicolas needs to get his system working again immediately, so he decrypts the folder by hand. After he does so, his system starts working as expected.

SCEN-040: Deploying and supporting the EFS Assistant in the enterprise environment

Personas:

Meg Collins, Quentin Kelly

Scenario:

The pilot went well so Meg decides it is time to deploy the EFS Assistant to the entire enterprise. She wants to play it safe by configuring the tool to run in reporting only mode first. She uses the administrative interface to configure the appropriate settings, then uses her software distribution system to install the tool on each machine. The configuration information is also pushed to each laptop as is the setting which tells the tool to run on each logon.

After a few days, Meg checks the reports to see how the tool is functioning. She reviews a sample of representative systems and sees that her encryption settings are working as expected. She changes the configuration to turn off the reporting mode and run in encryption mode. She also configures the tool to display status balloons when the tool begins processing and when it finishes.

The next day, Quentin docks his laptop and starts it up. He logs into the network. After he has been logged in for a few minutes, he notices a small balloon in the corner of his screen. The balloon says that his computer is encrypting his files to protect the sensitive data they contain. He's a bit nervous about this, but remembers the memo that he saw a few days ago that this new tool was coming. He is given the option to click a link that will ensure that he never sees this balloon again. He'd like to continue to be reminded about this new process, so he decides not to disable this balloon. He somewhat apprehensively closes the balloon by clicking on the close button. Some time later, a new balloon pops up on Quentin's screen saying that his files are now encrypted. Again, he is given the option to not see the balloon next time. This time he decides to choose to never see this balloon again. When he does so, the balloon disappears. He notices that many of the files and folders on his system now have their names in green rather than black. He remembers that the memo said that this is because the files are encrypted. He browses around through his files and sees that all of his confidential files have green titles. He opens a few of them and sees that he can still open the files and that the performance of his computer does not seem to be any different. He is happy that his company took these steps to protect the employees data that he carries on his laptop.

Requirements

This section of the document discusses the various requirements for the EFS Assistant.

Consolidated Requirements List

Following are all the requirements for the EFS Assistant. In addition, this table shows the priority and source for the requirement as well as the priority of the scenario:

Req #	Requirement	Priority	Source
REQ-0010	There must be an installer		SCEN-010
REQ-0020	Installer must be able to install the tool itself		SCEN-010
REQ-0030	Installer must be able to add the tool to the start menu		SCEN-010
REQ-0040	Installer must provide options to install/not install various features		SCEN-010
REQ-0050	Installer must be able to configure default settings for an evaluator		SCEN-010
REQ-0060	Installer must provide help to user about what features should be installed based on the purpose of the installation		SCEN-010
REQ-0070	There must be guidance to help evaluators understand how to get familiar with the tool		SCEN-010
REQ-0080	There must be a way to configure the tool locally		SCEN-010
REQ-0090	There must be an administrative interface for configuring the tool		SCEN-010, SCEN-020, SCEN-030, SCEN-040
REQ-0095	There must be a way to configure the tool from a central location		SCEN-020, SCEN-030, SCEN-040
REQ-0100	There must be a way to find out exactly what the tool did after it ran		SCEN-010, SCEN-020, SCEN-030, SCEN-040
REQ-0110	There must be a way to return a system to the state it was in before the tool ran		SCEN-010
REQ-0120	The tool must support a reporting only mode that does not actually encrypt		SCEN-010
REQ-0130	The tool must support a minimal encryption mode that only encrypts the basic folders that can be encrypted		SCEN-010
REQ-0140	The tool must be able to be installed by typical software distribution tools		SCEN-020, SCEN-040
REQ-0150	It must be possible to configure the tool for subsets of users in the organization		SCEN-020
REQ-0160	It must be possible to instruct the installer to install tool components separately (e.g., tool itself, configuration templates, etc.)		SCEN-020
REQ-0170	It must be possible to configure the tool to run at various times (e.g., on authentication, from the start menu, etc.)		SCEN-020
REQ-0180	The tool must not run if it cannot find its configuration		SCEN-020
REQ-0190	There must be a sample document for communicating about the EFS Assistant that administrators can send to users		SCEN-020, SCEN-040
REQ-0200	It must be possible to configure the tool to only encrypt specific folders		SCEN-020
REQ-0210	The tool must suspend when the laptop is running on battery power and resume when AC power returns		SCEN-020
REQ-0220	The tool must continue to function when the laptop is undocked or docked		SCEN-020
REQ-0230	It must be possible to configure certain folders to be encrypted		SCEN-020
REQ-0240	When a folder is configured to be encrypted, all its subfolders will also be encrypted		SCEN-020
REQ-0250	It must be possible to configure certain folders not to be encrypted		SCEN-020, SCEN-030
REQ-0260	When a folder is configured not to be encrypted, all its subfolders will also not be encrypted		SCEN-020
REQ-0270	The tool must know about certain default folders that should be encrypted		SCEN-020
REQ-0280	The tool must know about certain default folders that should not be encrypted		SCEN-020
REQ-0290	Configurations set by the administrator will override default settings		SCEN-020
REQ-0300	There must be a way to a gather the results of the tools run from a cental system such as SMS		SCEN-020
REQ-0310	There must be a way to encrypt uncategorized folders if the contain only data files		SCEN-030
REQ-0320	The tool be able to encrypt all data files no matter where they are		SCEN-030
REQ-0330	The tool should run on laptops that are used by only a single person		SCEN-030
REQ-0340	There must be a way to have a subset of all laptops have a unique configuration from the others		SCEN-030
REQ-0350	The tool must be able to encrypt all folders on a laptop except those specifically excluded by the administrator		SCEN-030
REQ-0360	The tool must be able to decrypt encrypted folders on the do not encrypt list	P3	SCEN-030
REQ-0370	There must be a guide describing how to install and configure the tool		SCEN-010, SCEN-020, SCEN-030, SCEN-040
REQ-0380	The guidance must explain how to support users when things go wrong		SCEN-030
REQ-0390	There must be a way to gather and view results centrally		SCEN-020, SCEN-030, SCEN-040
REQ-0400	The tool must be able to display status balloons when it starts and when it finishes		SCEN-040
REQ-0410	The administrator must be able to turn on or off the display of status balloons		SCEN-040
REQ-0420	The tool must be able to delay for a while before starting to minimize start up time	P2	SCEN-040
REQ-0430	It must be possible to close the start up and finishing status balloons		SCEN-040
REQ-0440	It must be possible to choose to not see a the start up of finishing balloons on subsequent runs of the tool		SCEN-040
REQ-0450	The user should be able to turn off one balloon without impacting the display of the other		SCEN-040
REQ-0460	The tool must not have a significant imact on system performance		SCEN-040
REQ-0470	The tool must run on Windows Vista	P1	SCEN-010, SCEN-020, SCEN-030
REQ-0480	The tool must run on Windows XP SP2	P1	SCEN-040
REQ-5000	There must be a way to quickly configure the tool to not run		Non-Functional
REQ-5010	The tool must coexist with antivirus tools		Non-Functional
REQ-5020	The tool must coexist with backup tools		Non-Functional
REQ-5030	The tool must run on typically configured mobile computers		Non-Functional
REQ-5040	The tool should gracefully handle shutdown via the Task Manager		Non-Functional
REQ-5050	The tool should log errors and continue operation whenever possible		Non-Functional
REQ-5060	The tool should detect the default language of the system and run in that language		Non-Functional
REQ-5070	The installer should detect the default language of the system and run in that language		Non-Functional
REQ-5080	The tool should support running on non-English versions of Windows		Non-Functional
REQ-5090	The tool should support encrypting folders that are configured to roam using Roaming User Profiles		Non-Functional
REQ-5100	The tool should support leaving folders that are configured to roam using Roaming User Profiles unencrypted		Non-Functional
REQ-5110	The tool should support uncompressing folders in order to encrypt them		Non-Functional
REQ-5120	The tool should support leaving compressed folders unencrypted		Non-Functional
REQ-5130	The tool should support encrypting shared folders		Non-Functional
REQ-5140	The tool should support leaving shared folders unencrypted		Non-Functional
REQ-5150	The tool should preserve file and folder modification dates		Non-Functional
REQ-6000	The tool must run on laptops that are used by multiple users	P3	Non-Goal

Features

FEAT-010: Installer
FEAT-020: Configuration utility
FEAT-030: EFS Assistant software
FEAT-040: Reporting tool

Configuration Options

This section describes the configuration options available and how they work.

Administrative Settings

Following is the complete list of configuration options available to the administrator via the administrative interface:

Configuration Option	Possible Settings (Default in bold)	Purpose
Reporting Mode	Enabled or Disabled	Tells the tool if it should just report on the encryption it would perform or actually perform the encryption. This setting is intended for testing and evaluation of the tool. NOTE: When this setting is enabled, the tool will not cause any data to be protected.
Folder encryption mode	Specified folders only; Specified folders and categorize based on files; Maximize number of folders encrypted	This setting tells the tool if it should only encrypt folders that the administrator has specified or are defaults (Specified folders only), if it should encrypt the previous folders plus folders that only contain data files (Specified folders and categorize based on files), or if it should encrypt all folders that are not specifically classified by the administrator as red (Maximize number of folders encrypted). NOTE: There is no default for this setting. If it is not configured, the tool will not run.
Encrypt individual files	Enabled; Disabled	Enabling this setting will cause files of the types listed in the 'File types to encrypt' setting to be encrypted if they are found in uncategorized folders. See below for exact details of how this setting and the 'Folder encryption mode' setting work together.
Debug logging	Enabled; Disabled	When enabled, turns on debug logging
Folders to encrypt	List of folders (No default)	This is the list of folders that the administrator wants encrypted. When a folder is in this list, all folders under that folder will also be encrypted, unless overridden an entry in the "Folders not to encrypt" list.
Folders not to encrypt	List of folders (No default)	This is the list of folders that the administrator wants not to encrypt. When a folder is in this list, all folders under that folder will also not be encrypted, unless overridden an entry in the "Folders to encrypt" list.
File types to encrypt	List of file extensions (No default)	This list of extensions serves two purposes. First, it is used as the list of data file types for folder content classification. Second, when "Individual file encryption" is enabled, files of these types will be encrypted. See the "Interaction of Settings" section for more information.
Force decompression of folders to be encrypted	Enabled; Disabled	Enabling this setting will cause compressed folders to be decompressed so that they can be encrypted.
Encrypt shared folders	Enabled; Disabled	Enabling this setting will cause encryption of folders that are marked as shared folders. Encrypting these folders may prevent other users from accessing them successfully.
Encrypt Roaming User Profile (RUP) folders	Enabled; Disabled	Enabling this setting will cause RUP folders to be encrypted.
Display status balloons	Enabled; Disabled	Enabling this setting will cause status balloons to be displayed when the tool starts up and finishes.

Interaction of Settings

The following table describes how the two main administrative settings, Folder encryption mode and Encrypt individual files, should work together to achieve various levels of encryption coverage:

	Folder encryption mode: Specified folders only	Folder encryption mode: Specified folders and categorize by files	Folder encryption mode: Maximized number of folders encrypted
Encrypt individual files Disabled or not configured	All specified folders only	All specified folders and folders categorized by file	All non-red folders
Encrypt individual files Enabled	All specified folders; individual files in uncategorizable folders	All specified folders and folders categorized by file; individual files in uncategorizable folders	All non-red folders; Encrypt individual files setting has no effect

NOTES:

Folder content classification is based on the list of file extensions configured by the "File types to encrypt" setting.
When encrypting individual files, the files to be encrypted are those configured by the "File types to encrypt" setting.
No matter what the combination of these two settings, if Reporting mode is enabled, the tool will not actually encrypt anything. Instead, it will report on what it would have done.

Definitions

Term	Definition
Red Folder	A folder that should not be encrypted.
Green Folder	A folder that should be encrypted.
Uncategorized Folder	A folder that is not configured as either a red or green folder.
Folder content classification	A process by which the tool attempts to figure out whether a folder should be marked for encryption based upon the files that are in the folder.
Yellow Folder	Synonymous with Uncategorized Folder.

UPDATED WIKI: EFS Assistant Design

billcan — Wed, 18 Apr 2007 01:13:53 GMT

Reporting

The following information will be stored in the WMI database by the tool:

Name - Full pathname of the file/folder
FolderClassification - Contains the folder classification the tool made:

Green - The folder should be encrypted
Yellow - Unable to determine if the folder should be encrypted
Red - The folder should not be encrypted
N/A - The entry is a file, so not applicable

SourceOfClassification - Gives the reason why the folder/file was encrypted:

System Folder
Not able to classify (for all yellow folders)
FileCategorization
EncryptByFiles
Inherited Green
Inherited Red
More (please list)

EncryptionStatus - Indicates whether the file/folder was or was not encrypted:

0 - indicates the file/folder was not successfully encrypted
1 - indicates the file/folder was encrypted

EncryptionSubStatus - When something is not encrypted, this gives the reason. Possible reasons include:

Error occured
Compressed folder when autodecompress is not specified
Shared folder when encrypt shared folders is not specified
Etc. (Please enumerate)

Tick - number of ticks on the system when the file was acted upon