We have a client who would like to encrypt data with EFS. The client would
like to have it setup so that all data folders are encrypted by default. The
client would also like to have it setup that new directories created by the
user are also tagged for encryption by default. Basically the client doesn't
want the user to "accidentally" have unencrypted data on the hard drive.
I am looking for an alternative to Whole Disk Encryption products, and I
would like to use EFS. I know EFS can not be used to protect system files or
the root directory. That's ok. My question is, can I use the cipher.exe
command to set all possible (non-system, non-root) directories to be tagged
for encryption? I am thinking about the following command:
cipher /e /i /s:c:\
I believe this will set the encryption flag for all directories starting the
root directory, and ignoring the errors (for c:\, c:\windows, & any other
system directories). My understanding is that this flag means any new files
or directories created or copied into these "encrypted-flagged" directories
will be encrypted on the write.
Then, a second command of:
cipher /e /a
could be used to actually encrypt the file data in certain directories such
as My Documents to encrypt current, existing data on the hard drive.
Does anyone have any experience with this?
Thanks
-MB