Manual

EFSprotectionutility
ClientSecuritySolutionprovidesacommandlineutilitythatenablesTPM-basedprotectionofencryption
certicatesusedbytheEncryptingFileSystem(EFS)toencryptlesandfolders.Thisutilitysupports
transferofthirdpartycerticates(certicatesgeneratedbyaCerticateAuthority)andalsosupports
generationofself-signedcerticates.
ProtectionoftheEFScerticatebyClientSecuritySolutionmeansthattheprivatekeyassociatedwiththe
EFScerticateisprotectedbytheTPM.Accesstothecerticateisgrantedaftertheuserhasauthenticated
toClientSecuritySolution.
IfnoTPMisavailable,theEFScerticateisprotectedusingtheTPMemulatorprovidedbyClientSecurity
Solution.YoumustbeenrolledwithClientSecuritySolutiontobeabletohavetheEFScerticatesprotected
byClientSecuritySolution.
CAUTION:
IfyouuseClientSecuritySolutionandtheEncryptingFileSystem(EFS)toencryptlesandfolders,
thenanytimeClientSecuritySolutionortheTrustedPlatformModuleisnotavailable,youcannot
accesstheencryptedles.
IftheTrustedPlatformModulebecomesnon-responsive,ClientSecuritySolutionwillrestoreaccessto
encrypteddataafterthemotherboardisreplaced.
UsingtheEFScommandlineutility
ThefollowingtableprovidesthecommandlineparametersthataresupportedforEFS:
Table9.CommandlineparameterssupportedforEFS
ParameterDescription
/generate:<size>Generatesaself-signedcertandassociatesthecerticate
withEFS.If<size>isspecied,thekeygeneratedwillbe
ofthespeciedbitsize.Validvaluesinclude512,1024
and2048.Ifnovalue,oraninvalidvalue,isspecied,the
defaultwillbethegenerationof1024-bitkeys.
/sn:xxxxxxSpeciestheserialnumberofanexistingcerticateto
transferandassociatewithEFS.
/cn:yyyyyySpeciesthename("issuedto")ofanexistingcerticate
totransferandassociatewithEFS.
/rstavailTransferstherstavailableexistingEFScerticateand
associatewithEFS.
/silent
Doesnotdisplayanyoutput.Returncodesprovidedby
thevaluewhentheprogramexits.
/?or/hor/help
Displaysthehelpinformation.
Whennotruninsilentmode,theutilitywillreturnoneofthefollowingerrors:
0-"Commandcompletedsuccessfully"
1-"ThisutilityrequiresWindowsXP"
2-"ThisutilityrequiresClientSecuritySolutionversion8.0"
3-"ThecurrentuserisnotenrolledwithClientSecuritySolution"
4-"Thespeciedcerticatecouldnotbefound"
5-"Unabletogenerateaself-signedcerticate”
6-"NoEFScerticateswerefound"
7-"UnabletoassociatethecerticatewithEFS”
Chapter3.WorkingwithClientSecuritySolution25