Printable View
سلام
دوستان خسته نباشید
اساتید من یک مشکلی دارم هر کاری کردم درست نشد
یکی از کاربران ما بعد از دسترسی و ورورد به شبکه تمام فایل هایی که داره به رنگ سبز در می آید (عنوان فایل) و دسترسی فایل برای همه به غیر خودش بسته می شود.
اگه کمک کنین ممنون میشم
ویندوز هم 2003 هست
کاربر مورد نظر Encrypt contents to secure data را بر روی فولدر مربوطه فعال نموده است .
روی فولدر کلیک راست کنید و از General کلید Advanced را بزنید و آنرا غیر فعال نمایید .
یک فولدر خاص نیست که
کلیه جاهایی که دسترسی پیدا میکنه اینطوری میشه؟
[QUOTE=saeedkheir;292876]سلام
دوستان خسته نباشید
اساتید من یک مشکلی دارم هر کاری کردم درست نشد
یکی از کاربران ما بعد از دسترسی و ورورد به شبکه تمام فایل هایی که داره به رنگ سبز در می آید (عنوان فایل) و دسترسی فایل برای همه به غیر خودش بسته می شود.
اگه کمک کنین ممنون میشم
ویندوز هم 2003 هست[/QUOTE]
خدا بفریادتان رسیده که از روی رنگ کنجکاو شدید وگر نه ...........
از GPO نمیشه تنظیماتی کرد که این خصوصیت حل بشه ؟
[LEFT][LTR]EFS has two levels of configuration. The first level is set at the computer level, which dictates whether or not it will even be supported and available. The second level is at the folder and file level, which performs the encryption on the data.
Windows 2000 (Server and Professional), Windows XP Professional, Windows Server 2003, Windows Vista, and Windows Server 2008 all support encryption of the data that resides on the computer. By default, all of these computers support encryption of data using EFS. Of course, this can be a negative thing, as some data or some computers should not encrypt data due to logistics.
The logistics that I am referring to is that of allowing users to encrypt data. Since all computers support encryption by default and any user can encrypt, data can be encrypted on the local desktop, as well as on data that is shared on the network. Figure 1 illustrates the option where data can be encrypted on a Windows XP Professional computer.
[B][IMG]http://www.windowsecurity.com/img/upl/image0021208779902212.jpg[/IMG]
Figure 1:[/B] Encryption of data is a property of the data
To access the encryption option shown in Figure 1, you just need to access the properties of the file or folder that you want to encrypt by right-clicking on the object, then selecting Properties. Then, select the Advanced button on the Properties dialog box, which will in turn show the Advanced Attributes dialog box.
[B]Controlling the Support of EFS for Computers in an Active Directory Domain[/B]
When a computer joins an Active Directory domain, it no longer is in control over whether or not it supports EFS. Instead, the Default Domain Policy stored in Active Directory controls this capability. All computers that are joined to a Windows Active Directory domain support EFS, simply by joining the domain.
The caveat is that Windows 2000 domains handle this configuration in the Default Domain Policy differently than Windows Server 2003 and Windows Server 2008 domains.
[B]Windows 2000 Domains Control over EFS[/B]
Windows 2000 computers support EFS differently than later operating systems, which is why the configuration for EFS is different in the Default Domain Policy. For Windows 2000, the key to enabling and disabling EFS is all based on the EFS data recovery agent certificate being included in the Default Domain Policy. By default, the Administrator account has this certificate and is configured as the data recovery agent. (If there is no certificate for data recovery, EFS fails.)
To access this configuration in the Default Domain Policy, follow this path once you are editing the GPO in the Group Policy Editor:
[I]Computer Configuration\Windows Settings\Security Settings\Public Key Policies\Encrypted Data Recovery Agents[/I]
At this location, you will see the EFS File Encryption Certificate for the Administrator, as shown in Figure 2.
[B][IMG]http://www.windowsecurity.com/img/upl/image0041208779902228.jpg[/IMG]
Figure 2:[/B] Windows 2000 domains show the EFS File Encryption Certificate just as the user’s name, like Administrator
This configuration is what provides all computers the ability to encrypt files. In order to remove this capability, you would just delete the Administrator certification from the GPO. If you wanted to then provide EFS to just a few computers in Active Directory, you would follow these steps:
[LIST=1][*]Create a new GPO and link it to an organizational unit that contains all of the computers that need to support encryption.[*]Access the Encrypted Data Recovery Agents node in the GPO and add in a certificate that supports EFS data recovery.[/LIST]
This will provide the computes affected with the GPO the ability to use EFS for the data that is stored on the computers.
[B]Windows 2003 and 2008 Domains Control over EFS[/B]
The newer domains and operating systems (those later than Windows 2000) support EFS in a similar fashion, but do have some unique differences.
[LIST=1][*]No data recovery agent is needed to encrypt on post Windows 2000 computers.[*]EFS is not controlled by the inclusion of the data recovery agent certificate in the GPO.[*]EFS supports multiple user access to encrypted files.[/LIST]
Therefore, for Windows 2003 and 2008 domains, you will have a different set of tasks to perform in order to control EFS for domain based computers. The setting still exists in the Default Domain Policy though. The new path that you will need to access is:
[I]Computer Configuration\Windows Settings\Security Settings\Public Key Policies\Encrypting File System[/I]
Now, instead of modifying the data recovery agent, you will need to right-click on the Encrypting File System node. From the menu option displayed, select Properties. From there, you will see there is a check box that says “Allow users to encrypt files using Encrypting File System (EFS)” on your Windows 2003 domains. Windows Server 2008 domains have radically changed the interface, providing granular support of EFS from this Property page, as shown in Figure 3.
[B][IMG]http://www.windowsecurity.com/img/upl/image0061208779902228.jpg[/IMG]
Figure 3:[/B] Windows Server 2008 provides granular control over EFS
Notice on the General tab there is a radio button that says “Don’t allow”. This is the configuration that can be set to disable EFS on all computers in the domain. Also notice that there are many other settings available in this dialog box for controlling EFS.
[/LTR][/LEFT]
