decrypting email in pst file with efs data recovery certificate???

[philipingrandisson]

(Excuse my english, i'm french)

I wish to encrypt my mail communication between the users in my internal
network. I use my certificate autority to distribute users certificates who
their allows to make it.

I noticed during my tests that it’s not possible to use my efs recovery
agent to decrypt the coded emails which is in the ,PST files of my users. How
may I get back these important emails in case of needs?

thanks

 

[Brian Komar]

S/MIME is not EFS! An EFS Recovery agent certificate has absolutely no
access to encrypted emails.
The only way you are going to be able to recover email is to implement Key
Escrow.
This requires the use of version 2 certificate templates, and an enterprise
CA running on Windows Server 2003 Enterprise Edition.

Brian
"philipingrandisson" <philipingrandisson@discussions.microsoft.com> wrote in
message news:3FBCC384-C8F3-46A6-90B3-259191860FA7@microsoft.com...
> (Excuse my english, i'm french)
>
> I wish to encrypt my mail communication between the users in my internal
> network. I use my certificate autority to distribute users certificates
> who
> their allows to make it.
>
> I noticed during my tests that it’s not possible to use my efs recovery
> agent to decrypt the coded emails which is in the ,PST files of my users.
> How
> may I get back these important emails in case of needs?
>
> thanks
>

 

[philipingrandisson]

Re: decrypting email in pst file with efs data recovery certificat

yes, i have an entreprise CA running on my network and it running on windows
server 2003 entreprise R2.

Did you have a procedure to do this and to explain key Escrow?

thanks.

"Brian Komar" wrote:

> S/MIME is not EFS! An EFS Recovery agent certificate has absolutely no
> access to encrypted emails.
> The only way you are going to be able to recover email is to implement Key
> Escrow.
> This requires the use of version 2 certificate templates, and an enterprise
> CA running on Windows Server 2003 Enterprise Edition.
>
> Brian
> "philipingrandisson" <philipingrandisson@discussions.microsoft.com> wrote in
> message news:3FBCC384-C8F3-46A6-90B3-259191860FA7@microsoft.com...
> > (Excuse my english, i'm french)
> >
> > I wish to encrypt my mail communication between the users in my internal
> > network. I use my certificate autority to distribute users certificates
> > who
> > their allows to make it.
> >
> > I noticed during my tests that it’s not possible to use my efs recovery
> > agent to decrypt the coded emails which is in the ,PST files of my users.
> > How
> > may I get back these important emails in case of needs?
> >
> > thanks
> >
>

 

[Brian Komar]

Re: decrypting email in pst file with efs data recovery certificat

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/kyacws03.mspx
Brian

"philipingrandisson" <philipingrandisson@discussions.microsoft.com> wrote in
message news:1AC2307F-1F51-4DD1-848E-0BE992C6BACC@microsoft.com...
> yes, i have an entreprise CA running on my network and it running on
> windows
> server 2003 entreprise R2.
>
> Did you have a procedure to do this and to explain key Escrow?
>
> thanks.
>
> "Brian Komar" wrote:
>
>> S/MIME is not EFS! An EFS Recovery agent certificate has absolutely no
>> access to encrypted emails.
>> The only way you are going to be able to recover email is to implement
>> Key
>> Escrow.
>> This requires the use of version 2 certificate templates, and an
>> enterprise
>> CA running on Windows Server 2003 Enterprise Edition.
>>
>> Brian
>> "philipingrandisson" <philipingrandisson@discussions.microsoft.com> wrote
>> in
>> message news:3FBCC384-C8F3-46A6-90B3-259191860FA7@microsoft.com...
>> > (Excuse my english, i'm french)
>> >
>> > I wish to encrypt my mail communication between the users in my
>> > internal
>> > network. I use my certificate autority to distribute users certificates
>> > who
>> > their allows to make it.
>> >
>> > I noticed during my tests that it’s not possible to use my efs recovery
>> > agent to decrypt the coded emails which is in the ,PST files of my
>> > users.
>> > How
>> > may I get back these important emails in case of needs?
>> >
>> > thanks
>> >
>>