One of the major downsides to EFS, especially from an administrator's point of view, is that it is difficult to manage centrally.  My team is creating a tool that will help address that situation.  We call this tool the EFS Assistant.  Basically, the EFS Assistant is a small software application that is installed on a user's laptop (or desktop) that enforces the encryption policy the administrator pushed to the client via Group Policy.  The beta version of the tool can do the following:

  • Encrypt specific default folders that Microsoft recommends (e.g., My Documents, etc.)
  • Encrypt additional folders as configured by the administrator (for example, a folder holding data for a custom-built application)
  • Do not encrypt default folders that Microsoft recommends leaving unencrypted (e.g., Program Files, Windows directory)
  • Do not encrypt folders as configured by the administrator (for example, the application files for a custom-built application)
  • Scan the disk and encrypt folders that mostly or exclusively contain data files
  • Record the results of its encryption run in WMI for reporting via SMS or other management tools

The tool has some additional capabilities that you will see if you download the beta when it becomes available next week.  If you are interested in this tool and would liketo participate in the beta program, please join our program on Microsoft Connect by visiting the following URL: https://connect.microsoft.com/InvitationUse.aspx?ProgramID=790&InvitationID=DESA-QYGY-T4HB&SiteID=14.  When the beta becomes available, you will get an email notification.

The EFS Assistant a component of the Data Encryption Toolkit for Mobile PCs.  The Toolkit is a set of guidance and tools to help address the unique risks to data presented by laptops using Microsoft technologies.