I wanted to let everyone know that the issue has been resolved and
was not related to KB887742 as initially thought. The problem was that the
recovery agent certificate referenced in our domain group policy had
expired. Once a new certificate was generated (with cipher /k) and
referenced the problem went away. Clients who experienced problems only had
to run "cipher /u" to update their encrypted files with the right hey
information.
FYI - The reason it was not mattering if you logged in as a local or
domain account was because the GP had already been applied to the machine.
Once the machine was removed from the domain EFS worked properly.
Thanks for the responses,
Mike Libby
ISX Corporation
-----Original Message-----
From: Windows NTBugtraq Mailing List
[mailto:NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM] On Behalf Of Mike Libby
Sent: Friday, March 18, 2005 1:51 PM
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: MS KB887742 Install and EFS
I have encountered a problem with installing the fix for
KB887742 onto an XP professional machine in a domain environment breaking
EFS. This happens whether or not you login with a domain account. The
error received when encrypting objects is "Recovery policy configured for
this system contains invalid recovery certificate". I am curious to see if
anyone else has experienced a similar problem and if so, if there are
suggested solutions to the problem.
Thanks,
Mike Libby
ISX Corporation
--
NTBugtraq Editor's Note:
Most viruses these days use spoofed email addresses. As such, using an
Anti-Virus product which automatically notifies the perceived sender of a
message it believes is infected may well cause more harm than good. Someone
who did not actually send you a virus may receive the notification and
scramble their support staff to find an infection which never existed in the
first place. Suggest such notifications be disabled by whomever is
responsible for your AV, or at least that the idea is considered.
--
--
NTBugtraq Editor's Note:
Most viruses these days use spoofed email addresses. As such, using an
Anti-Virus product which automatically notifies the perceived sender of a
message it believes is infected may well cause more harm than good. Someone who
did not actually send you a virus may receive the notification and scramble
their support staff to find an infection which never existed in the first
place. Suggest such notifications be disabled by whomever is responsible for
your AV, or at least that the idea is considered.
--
