2.2 Given a scenario, configure and apply basic Microsoft Windows OS security settings.
📘CompTIA A+ Core 2 (220-1202)
What is Encrypting File System (EFS)?
Encrypting File System (EFS) is a Windows security feature used to encrypt files and folders stored on a computer’s hard drive.
- EFS protects data at rest (data stored on disk)
- Only the user who encrypted the file (or an authorized recovery account) can open it
- If someone else logs into the same computer, they cannot read the encrypted files
EFS is mainly used to protect confidential business or personal files on Windows systems.
Why EFS is Important (Exam Perspective)
EFS helps prevent:
- Unauthorized access to sensitive files
- Data exposure if someone gains access to the computer or removes the hard drive
- Accidental access by other users on the same Windows system
CompTIA exam focus:
EFS is a file-level encryption method built into Windows.
Where EFS Is Available
EFS is available on:
- Windows Professional
- Windows Enterprise
- Windows Education
EFS is NOT available on:
- Windows Home edition ❌
How EFS Works (Simple Explanation)
- A user encrypts a file or folder
- Windows automatically generates an encryption key
- The file is encrypted using that key
- The key is protected by the user’s Windows account
Only that user (or a configured recovery agent) can decrypt and open the file.
What Can Be Encrypted with EFS
EFS can encrypt:
- Individual files
- Entire folders (all files inside are encrypted automatically)
EFS cannot encrypt:
- System files
- Program files
- Files on FAT32 or exFAT file systems
- Files on removable drives formatted without NTFS
Important exam point:
👉 EFS requires the NTFS file system
NTFS Requirement (Very Important for Exam)
- EFS works only on NTFS-formatted drives
- If the drive is FAT32 or exFAT, EFS will not work
How to Enable EFS (Basic Steps – Exam Knowledge)
- Right-click the file or folder
- Select Properties
- Click Advanced
- Check Encrypt contents to secure data
- Click OK and Apply
Windows handles encryption automatically after this.
How Encrypted Files Appear
- Encrypted files and folders usually appear in green text in File Explorer
- This visual indicator helps identify encrypted data quickly
Who Can Access EFS-Encrypted Files
- The user who encrypted the file
- A Data Recovery Agent (DRA) if configured
- System processes running under that user’s account
Other users:
- Can see the file name
- Cannot open or read the contents
Data Recovery Agent (DRA)
A Data Recovery Agent is an account that can recover encrypted files if the original user:
- Loses their password
- Deletes their profile
- Leaves the organization
Exam point:
DRAs are commonly used in business environments to prevent permanent data loss.
EFS and User Passwords
- EFS encryption keys are tied to the user account
- Changing the password normally does not break EFS
- Resetting a password improperly can cause loss of access
Best practice:
Always back up EFS certificates.
EFS Certificate and Backup (Very Important)
When EFS is first used:
- Windows creates an encryption certificate
If the certificate is lost:
- Encrypted files may become permanently inaccessible
Exam tip:
Always back up the EFS certificate.
Backing Up an EFS Certificate
Users can export their EFS certificate:
- Using Certificate Manager
- Saved as a file with a password
This allows recovery if:
- The user profile is damaged
- The system is reinstalled
EFS vs BitLocker (Common Exam Comparison)
| Feature | EFS | BitLocker |
|---|---|---|
| Encryption type | File/folder level | Full disk |
| Protects | Individual files | Entire drive |
| User-based | Yes | No |
| Requires NTFS | Yes | Yes |
| Best for | Specific files | Whole system |
Exam focus:
- EFS = file-level encryption
- BitLocker = disk-level encryption
Limitations of EFS
- Does not protect files sent over a network
- Does not protect data once copied to non-NTFS drives
- Not available in Windows Home
- If certificate is lost, data may be unrecoverable
When EFS Is Commonly Used (IT Environment)
- Protecting confidential documents on shared computers
- Securing user data on local hard drives
- Preventing other local users from accessing private files
Key Exam Points to Remember
✔ EFS encrypts files and folders, not entire drives
✔ Works only on NTFS
✔ Available in Professional and higher editions
✔ Uses user-based encryption certificates
✔ Supports Data Recovery Agents
✔ Different from BitLocker
One-Line Exam Summary
Encrypting File System (EFS) is a Windows NTFS feature that encrypts individual files and folders so only authorized users can access the data.
