EFS Assistant (Community Edition)

NEW POST: Is there any support for this at all?

JimKnight — Fri, 09 May 2008 18:37:51 GMT

Seems like activity here has been pretty non-existant and I have seen several requests for support with no answer. Did microsoft abandon this product and pawn it off on the community?

NEW POST: Is there any support for this at all?

JimKnight — Fri, 09 May 2008 18:37:51 GMT

Seems like activity here has been pretty non-existant and I have seen several requests for support with no answer. Did microsoft abandon this product and pawn it off on the community?

NEW POST: EFSAssistant Takes too long to run

Kenbe — Mon, 21 Apr 2008 17:40:21 GMT

Help with clairifying how EFSAssistant works...

Here is my understanding: I have EFSA set to use Folder Encryption, specifying a green list and list of folders not to encrypt. I'm noticing that it EFSA is scanning the whole drive to catagorize it, which is taking up to an hour and more on some users, when they only have 25mb of data to encrypt. Why does EFSA look at the whole drive and not just the folders in the green list? When I add folders to the "do not encrypt list", they are getting ignored and still showing up on the debug log as access denied. Why don't these folders get ignored, they are in the red list.

Here is what I'm trying to achieve: encrypt everything on the Desktop and in My Documents. I don't want EFSA looking anywhere else. Can anyone help please???

NEW POST: Decrypt All Folders Option, support alternate scheduling options

DaveMo — Tue, 04 Mar 2008 00:51:19 GMT

Hey all,

The proper way to do this is to add a background thread that sleeps after the first run (at logon) until a certain time has passed at which time it runs again. This is relatively simple to implement, but I'm not sure that I have the time right now. For those interested in such capability, drop me a line at david.mowers@securitay.com.nospam (delete the nospam portion) and we can discuss timing.

Thanks!
Dave

COMMENTED ISSUE: XP Tablet PC Edition and Media Center Edition 2005

DaveMo — Tue, 04 Mar 2008 00:40:33 GMT

EFS Assistant seems to crash on Tablet PC Edition 2005. Has Microsoft tested it with SKUs other than XP Professional? Most laptops especially have these operating systems. The error msg is attached as a JPEG file.
Comments: ** Comment from web user: DaveMo **

Hello,

Although it was not officially tested on Tablet, I believe that the PM for the project was running Tablet and ran the software on that OS for the duration without any issue. Do you have the ability to run the EFSA on the tablet with Visual Studio installed so we can find out where the issue might be?

Dave

NEW POST: Decrypt All Folders Option, support alternate scheduling options

shudman — Thu, 28 Feb 2008 10:25:38 GMT

Hi Mike,
I am not a coder either, so I can't really answer any of your questions, sorry. I can furnish some more about how we have worked around it though. We had one of our guys knock up some code, that was launched everytime the user was logged in and it is basically a stub scheduler to kick off any application (registry defined) in the context of the user. So, in our case, this app runs all of the time, and then every 15 mins, it calls the EFS Assistant EXE under the current user's context. It means our scheduler is running all the time (uses minmal memory), but atleast we can remotely tweak times with GPOs and add additional EXEs if we wanted. Not elegant, but reasonably affective.

NEW POST: Decrypt All Folders Option, support alternate scheduling options

MikeSL — Sat, 23 Feb 2008 23:17:34 GMT

Stuart, Eric, I've been working on other projects and haven't spent any time on EFS Assistant since these discussion threads slowed down. I generally don't have a ton of spare time, and when I do there's so many other things on my radar that it's hard to comeback to "old code". (Plus, I have to admit that as my first open-source project, I had higher expectations of how many folks would offer to contribute to the codebase, which never materialized, and that disappointment has seriously harmed my attitude towards this project. I'm not proud of it, but that's the unvarnished truth.)

I got to thinking last night about this request thread and how we could make this happen, leveraging your enthusiasm and interest, and my background with the code (and limited coding abilities). I have to tell you, my background in C# is pretty hit-or-miss, and while I'd love to say that I know how I'd code this scheduling capability, it's gonna take a lot of research.

Stuart, Eric, if either of you two have any time you'd be able to contribute to this research, I'll commit to implementing the code that is necessary to wire together whatever you can dig up. Here's a few thoughts to get you started:

are there any managed classes that wrap the Scheduler APIs?
are there any open-source projects that have tried to tackle managed code to wrap the Scheduler APIs (but aren't complete), or that have tried to implement a scheduler from scratch in managed code?
are there any WMI objects/methods that could be used for this? most WMI objects are accessible via the System.Management classes
are there any useful managed classes in the .NET Framework, or other framework additions like the Genghis Project, that would be used here?
would this scheduling interaction require the use of a separate thread in the EFSAssistant code?
if the scheduling required a separate thread, where should the thread "entry points" (I don't even know how to describe what I'm asking) be placed in the existing codebase?
would there need to be significant changes to the existing codebase?

Lastly, if either of you (or anyone else) has some background in coding (even if it's not .NET), and have some ideas on how a scheduler would be implemented, I'd be thrilled to hear it. If you can write any code that would either create a starting place for this effort, or even would be able to co-write the code with me, I'd be quite open to that.

Thanks everyone, and good luck hunting.

Mike

CREATED ISSUE: XP Tablet PC Edition and Media Center Edition 2005

tuxplorer — Sat, 01 Dec 2007 09:24:01 GMT

NEW POST: Support Questions

ejarosek — Wed, 07 Nov 2007 21:38:03 GMT

EFS Assistant does not encript files I get an erro in the application log that reads:
Event Type: Error
Event Source: EFS Assistant
Event Category: None
Event ID: 1011
Date: 11/7/2007
Time: 3:00:23 PM
User: N/A
Computer: SWN89501
Description:
Failed to write/update classification details to WMI. Error message Invalid namespace .

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

NEW POST: EFS Error 1011

ejarosek — Wed, 07 Nov 2007 21:36:23 GMT

When running the Efs Assistant I get an error in my application log:
Event Type: Error
Event Source: EFS Assistant
Event Category: None
Event ID: 1011
Date: 11/7/2007
Time: 3:00:23 PM
User: N/A
Computer: SWN89501
Description:
Failed to write/update classification details to WMI. Error message Invalid namespace .

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
When running the tool it does not enript anything.

NEW POST: Decrypt All Folders Option, support alternate scheduling options

shudman — Tue, 06 Nov 2007 23:56:19 GMT

I started off reading this thread thinking that I could solve our EFA Assistant scheduling issues....alas I have failed miserably. I have tried all iterations of schtasks.exe from Window 2003 and the XP codebase (the EXEs are actually different, as the 2003 supports the /IT flag). Actually got the commandline to create a task:
schtasks /create /sc:MINUTE /IT /MO 10 /ru fakeuser /rp "" /TN "OE" /TR "\"C:\Program Files\EFSA\EFSassistant.exe\"
without entering a password on a 2003 system. Problem is....the task will not start, unless I go into the scheduled tasks GUI and put a space at the end of the commandline ...then it works forever. Allegedly though, this is actually a bug and should never work !
Looking at the API calls, it doesn't even look like the Scheduler 1.0 APIs will allow us to do this in an autmated fashion :(

So....EFSAssistant devs folks, is there a way that we can actually get a scheduler into the app, because it seems external methods are really not up for it ? I appreciate what Mike says, but we are struggling to get EFSAssistant to run in the context of a user, on a frequent basis. Having it run at logon isn't really a good solution, as people don't login and logout that much anymore (standby and hibernate rules!). What other choices are there ? The tool is great, but without an scheduled enforcement method it really doesn't allow us to use it.

-Stuart

NEW POST: Support Questions

AJolly — Fri, 02 Nov 2007 01:33:23 GMT

EFS Assistant crashes everytime I try and run it on one of my machines (XP Tablet, SP2, all patches)
Any ideas? If you need me to do anything in order to help troubleshoot this issue, please let me know.

Thanks!

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 11/1/2007
Time: 6:44:23 PM
User: N/A
Computer: SYNTH
Description:
Application popup: EFSAssistant.exe - Common Language Runtime Debugging Services : Application has generated an exception that could not be handled.

Process id=0x37c (892), Thread id=0x14e4 (5348).

Click OK to terminate the application.
Click CANCEL to debug the application.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Source code checked in

MikeSL — Tue, 25 Sep 2007 05:35:57 GMT

v1.1 source, with Form_Closing() bug.

UPDATED WIKI: Home

billcan — Wed, 12 Sep 2007 20:55:08 GMT

Welcome to the home of the EFS Assistant (Community Edition)

Update (2007/08/14): We have released a new tool to aid in migrating users to non-self-signed EFS certificates. Have a look here.

Update (2007/05/27): The released version of the Microsoft EFS Assistant is now available! You can find it here.

This site is the home of the the EFS Assistant (Community Edition). The EFS Assistant is a tool that helps organizations centrally manage EFS in order to protect the data on their client PCs. The EFS Assistant is a small tool that installs on a Windows Vista or Windows XP SP2 machine and enforces the company's EFS encryption policy. The policy is configured using Group Policy.

Navigating this Project

Like most open source projects, this is a two-way street - you're welcome to use whatever we've made available here, and we strongly encourage feedback, bug reports, discussion and Patches (code submissions):

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, you can make yourself known to us by posting a reply to the Developers Wanted discussion topic, or you can simply submit a code fix, rewrite or addition via the Upload Patches page.

Project Documentation

NEW POST: Support Questions

Paulab — Wed, 05 Sep 2007 22:13:46 GMT

Hi,

We want to install EFS Assistant using Group Policy, but don't see how to change the default installation without an MST file. We would like to accomplish the following, but through GP instead of command line.

msiexec /qn -i EFSAssistant.msi REPORT=1 SHORTCUTS=1

Any ideas?

Thanks.

UPDATED WIKI: Home

MikeSL — Thu, 16 Aug 2007 15:20:22 GMT

Welcome to the home of the EFS Assistant (Community Edition)

Update (2007/08/14): We have released a new tool to aid in migrating users to non-self-signed EFS certificates. Have a look here.

Update (2007/05/27): The released version of the Microsoft EFS Assistant is now available! You can find it here.

Navigating this Project

Download and install a release - Releases can be found on the Releases tab. For information on how you can easily evaluate the tool, see the Evaluator's Guide. You may also be interested in the Functional Specification for some background on what the tool is intended to do.
Submit issues using the Issue Tracker - If you find a bug, let us know about it. If you have a feature you'd like to see, let us know that too!
Get support and ask questions - Use the Discussions tab above to ask the project team questions, or provide other feedback. We want to hear from you!
Help develop the EFS Assistant - If you are a developer and want to help make the EFS Assistant even better, you can make yourself known to us by posting a reply to the Developers Wanted discussion topic, or you can simply submit a code fix, rewrite or addition via the Upload Patches page.

Project Documentation

CREATED ISSUE: Leftover bugbug - additional exceptions in "if (_subStatus == EncryptionSubStatus.None)"

MikeSL — Wed, 15 Aug 2007 18:27:23 GMT

From Encryption.cs > EncryptFile()

if (_subStatus == EncryptionSubStatus.None)
{
try
{
//
// Preserve the original time stamp on the file
//
DateTime _lastWriteTimeUtc = File.GetLastWriteTimeUtc(fileName);
File.Encrypt(fileName);
File.SetLastWriteTimeUtc(fileName, _lastWriteTimeUtc);
_status = EncryptionStatus.Encrypted;
_subStatus = EncryptionSubStatus.NewlyEncrypted;

}
catch (Exception e)
{
Log.EFSAsstTrace("FailedToEncryptFile", fileName, e.Message);
// bugbug - there may be other reasons for a failure...
_subStatus = EncryptionSubStatus.AccessDenied;

CREATED ISSUE: .NET 1.1 compilation bug - FolderPathsToEncrypt() cannot use ExpandEnvironmentVariables()

MikeSL — Sat, 11 Aug 2007 15:55:43 GMT

From UtilityClass.FolderPathsToEncrypt source code:

// 1.1 bugbug - If this code is compiled in .NET 1.1 this will
// not work. EEV returns short path names and DirectoryInfo.FullName
// does not expand them in 1.1.
//
_path = Environment.ExpandEnvironmentVariables(_path);
_dirInfo = new DirectoryInfo(_path);
_path = _dirInfo.FullName;

COMMENTED ISSUE: CA2205 : UseManagedEquivalentsOfWin32Api in Win32API.cs - SHGetFolderPath()

MikeSL — Sun, 29 Jul 2007 23:44:57 GMT

Comments: ** Comment from web user: MikeSL **

Dave (and others), this bug is called straight out of FxCop.

Any non-standard implementations in a shared-source project are one heckuva lot easier to support, and preserve as an exception, with documentation or comments to clarify what issues such a non-standard implementation are meant to workaround.

If anyone knows what issues this would resurrect, their input would be MOST appreciated.

COMMENTED ISSUE: CA2205 : UseManagedEquivalentsOfWin32Api in Win32API.cs - SHGetFolderPath()

DaveMo — Sat, 28 Jul 2007 15:55:10 GMT

Comments: ** Comment from web user: DaveMo **

For any functionality where we had to use the unmanaged equivalent, it was because the managed version didn't function correctly. I don't know what the point of this issue is since if we revert to the managed equivalent something would stop working correctly.