Encrypting system files

[timtim41]

Hi, I was just wondering if it is safe to use EFS on important system files such as system32 documents and executables. I just want to make sure it is safe to do so before I actually do it. Thanks.

[Allan]

I wouldn't. First of all, what's the purpose? Second, if you ever lose the key you're completely out of luck.

[BC_Programmer]

You can't encrypt system files. Since they will be encrypted with your <current> account, the system files will be inaccessible to any other account, including administrator, Local Service, etc. Making the computer entirely unbootable.

Additionally, what are you trying to protect? What does encrypting, say, shell32.dll give you? Nothing. it makes the text green.

Encryption is about protecting secrets. encrypting a file that millions of other people have isn't protecting anything. It's utterly pointless.

[Allan]

You can't encrypt system files. Since they will be encrypted with your <current> account, the system files will be inaccessible to any other account, including administrator, Local Service, etc. Making the computer entirely unbootable.

You know what, I'm embarrassed to admit I hadn't even thought of that.

[Bromide]

A lot of people recommend whole disk encryption for laptops, or any other hard drive that might fall into the wrong hands. I don’t know anything about EFS, but Truecrypt will encrypt your whole hard drive and make it inaccessible to anyone who doesn’t have the password.

Once you boot up and log in the encryption is transparent and doesn’t affect the use of the drive.  I had my laptop disk encrypted for a year or two before I upgraded to Windows 7. I just haven’t bothered to encrypt the new installation, but I probably will. It protects files you don’t usually think about like page files, hibernation, deleted and temp files.
 

[BC_Programmer]

This is an important point right here.

People refer to "protecting" their files.

Protecting the files from what? I mean seriously, is there a band of thieves dead set at stealing all your Word documents or something? It just seems silly. In fact, EFS is far more likely to prevent the owner from accessing the file; especially if you use it on a removable drive. Like if you store your top secret letters to your nephew on a removable NTFS drive and encrypt them, and then forget about the drive, and reformat your OS... Now you cannot access the files at all. That IMO does not constitute protecting files.


Files are not something that <need> protecting. Secrets are what EFS is designed to protect. If there is nothing secret about what is in the file then it doesn't need protecting.

Also (IMO) protecting a file is properly done by backing it up.

[Allan]

Also (IMO) protecting a file is properly done by backing it up.

+1

[Bromide]

We all live very different lives and use our computers for our own particular purposes.  For gaming machines or home media PCs, security and encryption are not of much concern. But for PCs used as ‘electronic file cabinets’ security can be a major issue.

I keep PDFs of all my bank and credit card statements, medical records, tax returns, wills, trusts, investments and other things that could be used to steal my money and identity. It is a matter of principle to protect these things from being compromised.  Encryption is one of many steps I can take to reduce the risk of loss.

Both laptops and external drives are at higher than average risk of being lost or stolen in the course of daily life, so I agree with you that data backups are essential to good computer practice. But backups are to keep you from losing your data. Encryption is to keep other people from getting your data. That’s the difference.