Editing Windows 2000 (section)

=== Encrypting File System ===
{{main|Encrypting File System}}

The Encrypting File System (EFS) introduced strong [[file system]]-level [[encryption]] to Windows. It allows any folder or drive on an NTFS volume to be encrypted transparently by the user.<ref name="EFS" /> EFS works together with the EFS service, Microsoft's [[Cryptographic Application Programming Interface|CryptoAPI]] and the EFS File System [[Run time system|Runtime]] Library (FSRTL).<ref name="EFSWorking">{{Cite web |date=July 19, 2011 |title=How Encrypting File System Works |url=http://technet2.microsoft.com/windowsserver/en/library/997fdd99-73ec-4041-9cf4-1370739a59201033.mspx?mfr=true |url-status=dead |archive-url=https://web.archive.org/web/20070522034806/http://technet2.microsoft.com/windowsserver/en/library/997fdd99-73ec-4041-9cf4-1370739a59201033.mspx?mfr=true |archive-date=May 22, 2007 |access-date=November 13, 2011 |website=Technet2.microsoft.com |df=mdy-all}}</ref> To date, its encryption has not been compromised.{{citation needed|date=April 2014}}

EFS works by encrypting a file with a bulk [[symmetric key]] (also known as the File Encryption Key, or FEK), which is used because it takes less time to encrypt and decrypt large amounts of data than if an [[asymmetric key]] [[cipher]] were used.<ref name="EFSWorking" /> The symmetric key used to encrypt the file is then encrypted with a [[public key]] associated with the user who encrypted the file, and this encrypted data is stored in the header of the encrypted file. To decrypt the file, the file system uses the private key of the user to decrypt the symmetric key stored in the file header. It then uses the symmetric key to decrypt the file. Because this is done at the file system level, it is transparent to the user.<ref>"[http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/distrib/dsck_efs_xhkd.mspx?mfr=true Encrypting File System] {{Webarchive|url=https://web.archive.org/web/20090112173941/http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/distrib/dsck_efs_xhkd.mspx?mfr=true |date=January 12, 2009 }}." ''Microsoft''.</ref>

For a user losing access to their key, support for recovery agents that can decrypt files is built into EFS. A Recovery Agent is a user who is authorized by a public key recovery certificate to decrypt files belonging to other users using a special ''private key''. By default, local administrators are ''recovery agents'' however they can be customized using [[Group Policy]].