Win 7 EFS. An encrypted file can not be opened after importing prv key

dovob · 28 Oct 2014

My first post in SevenForums. Any guidance on where to post things, etc. appreciated! I did look for a forum on file system issues, then looked over all forums, then decided to post here.

I have a file containing sensitive info that I use daily. It's encrypted with Windows EFS, showing as green in Explorer.

My objective is to be able to use this file from multiple logins on the same computer.

The file was not stored on the system drive in a Users subfolder, but on a separate logical drive (same physical drive), under a folder named "xxx" that I use, for many purposes, as a substitute for the corresponding Users subfolder on the system drive (since it's basically user data rather than system or application data). Usage of this encrypted file has been trouble-free until today.

I've been using an elevated privilege login "xxx" for all my computing work. I recently decided to create a second login "yyy" for use in daily work. I intend to use the new "yyy" login with restricted privileges, but for now both logins are admins until I get comfortable using the new login.

After creating "yyy" while logged in as "xxx", I copied most of the contents of the "xxx" profile to the new user's profile directory. (As I'm typing this, Radar is suggesting my problem might be here - a brute-force workaround for the eternally-greyed-out "Copy to" feature in Windows 7 profile manager.)

While logged in as "xxx" I exported my certificate or private key (not really clear to me from the process) to a .pfx file. (I did opt to include other certificates.) I then switched login to "yyy" and navigated to the target file's folder. Noticing that the file was in my separate "xxx" data folder, and knowing that I now want to use the same file from either of my logins, I moved the encrypted file to a third subfolder on my data drive, whose parent I call "System" to remind me that its files should be login-neutral. (Moving the file from the new login before I tried to open it - Radar up?)

While logged in as "yyy" I imported the saved private key/certificate file into the same directory as the target file. When I tried opening the target file, I got a Windows dialog in the nature of "Excel cannot open the file because the file format or file extension not valid".

I switched login back to "xxx" and opened the file without incident. Restarted, logged in as "yyy" - same result "Excel cannot open the file because the file format or file extension not valid".

Searching yielded little other than a 2011 TechNet article stating that the problem was malware: http://*******/1wAmhE5 .. I downloaded and ran a Quick Scan with the linked utility - no infection found. (Yesterday I ran a full scan with current MSRT whose UI appears identical with this one's.)

I also tried searching for "how does an idiot like me APPLY an imported certificate or private key to a specific file"; evidently it doesn't work that way. I also found a lengthy, aging TechNet tutorial on everything I never want to know about EFS: http://*******/1wAnqf5

Why would this be difficult? Thanks for any ideas!

Edit: Thank you for letting me know not to try posting URL-shortened links. Will read up before posting again.

Tookeri · 28 Oct 2014

Hi and welcome to SevenForums!

I think you missed the part to add the certificate to the file, through the properties of the shared file.
Here's a good description: Share encrypted files

dovob · 29 Oct 2014

Thank you Tookeri. This info led to success!

Sorry for the delay in reporting back. (I really appreciate the prompt response - got busy with other things yesterday and then spent a bunch of time on it today.)

It seems that besides missing a step, I also had the process backwards in my mind. Per your linked reading, it's the "recipient" login that first Exports a certificate file (Step 1), then (according to the reading) the "donor" Imports it (Step 2). This seems to make sense only in light of Step 3 - Add the certificate to the target file to make that file decryptable by the "recipient".

I struggled for quite a while with Step 2 (Import). No matter how I tried to finagle things, each attempt to open the Exported certificate file from within Certificate Manager, resulted in a different-but-same Windows dialog indicating "You do not have permission to access the file." Which pretty clearly suggests NT Permissions - false. (All permissions in order and even taking ownership - same result.)

Finally, it turned out to be simpler than all that. For this particular situation (sharing an encrypted file with another user on same computer after flailing around for hours), only Step 3 was needed from the original "xxx" login. I just shared the target file with the new user's certificate as outlined in Step 3 of the reading. That enabled "yyy" to open the file.

In Step 3, I was able to find and select the new user's certificate easily. I don't think this was a result of "xxx" Importing a certificate file of "yyy" (Step 2), since every attempt I made to do that, resulted in "You do not have permission to access the file." I'm thinking that EITHER the certificate of "yyy" had been available from the start, having been built during the initial creation of user "yyy"; OR the certificate contained in the file that was built from the "yyy" login, didn't need to be Imported since it was sitting right there in the same directory.

So I'm thinking that maybe the directions in the reading aren't right. Maybe in the general case, one needs to EITHER Export a certificate while logged in as the "recipient" (Step 1) .. OR Import a certificate while logged on as the "donor" (Step 2); then (in either case) from the "donor" login Share the "recipient" certificate with the target file (Step 3).

Also I'm guessing that I misunderstood the directions for the Import (Step 2). Here I refer to the sub-step where the dialog asks me to "Select a file". Well, in Step 1 I'd already learned that this is Microglyphic for "Make up a new name for a file that doesn't exist yet, and type it into the text box." Sadly, during my struggles I failed to transfer this valuable info over to the Import step (where the dialog looked exactly the same as in Step 1 - duh), instead interpreting "Select a file" to mean "Select a file". Silly me! Had I made that connection, I might have decided that the instructions were combining 2 distinct and mutually exclusive processes into one description of a process that won't work.

But then .. I might have been wrong about that too! Fortunately this stuff actually is kind of fun.

Thank you for the help!