Windows Desktop Search and Encrypted Files

How can I get Windows Desktop Search to index my encrypted folders?

Right now, WDS doesn't return any results from my encrypted files. The files
are encrypted using Windows XP's EFS.

On Mon, 14 May 2007 10:54:01 -0700, Zian <Zian@discussions.microsoft.com>
wrote:

> How can I get Windows Desktop Search to index my encrypted folders?
>
> Right now, WDS doesn't return any results from my encrypted files. The files
> are encrypted using Windows XP's EFS.

The indexer is a service and runs under the local system account, which
means that it can't unencrypt those files. It doesn't have the key.

That's the point of using encryption. Indexing them would mean that parts
of those files end up in the (unencrypted) index, which would mean a
security risk.


There may be a workaround, if you don't mind a little less security. I
haven't tried if it works, but if the service is running under your user
account instead of local system, it should be able to index those files.

The account that the service runs under can be changed through the services
control panel.
You can specify only one account, so there's still the limitation that it
can only get to encrypted files belonging to one user account.

That's an interesting point. I'd always thought the service inherited the
security token from the notification area app.

I see what you mean though.

If I give it my credentials, then the database becomes a vulnerability
unless I lock it down. But if I lock it down, then other users won't be able
to use Windows Desktop Search.

Microsoft made the right choice for 99.999% of the users but for me, since
the other account is just an emergency account, I don't mind not having WDS
on it.
-Zian

I hope that the access denied errors that WDS will get in the other account
won't confuse WDS though. Here's hoping to good QA at Microsoft.

"Lucvdv" wrote:

> On Mon, 14 May 2007 10:54:01 -0700, Zian <Zian@discussions.microsoft.com>
> wrote:
>
> > How can I get Windows Desktop Search to index my encrypted folders?
> >
> > Right now, WDS doesn't return any results from my encrypted files. The files
> > are encrypted using Windows XP's EFS.
>
> The indexer is a service and runs under the local system account, which
> means that it can't unencrypt those files. It doesn't have the key.
>
> That's the point of using encryption. Indexing them would mean that parts
> of those files end up in the (unencrypted) index, which would mean a
> security risk.
>
>
> There may be a workaround, if you don't mind a little less security. I
> haven't tried if it works, but if the service is running under your user
> account instead of local system, it should be able to index those files.
>
> The account that the service runs under can be changed through the services
> control panel.
> You can specify only one account, so there's still the limitation that it
> can only get to encrypted files belonging to one user account.
>

On Mon, 14 May 2007 23:40:01 -0700, Zian <Zian@discussions.microsoft.com>
wrote:

> That's an interesting point. I'd always thought the service inherited the
> security token from the notification area app.

I'm not saying that's exactly how it is, I was just giving it my best
guess. Sorry if I made the impression that I'm an expert on the field


But if it worked differently (i.e. using the credentials of the logged on
user), that would practically mean the indexer has to stop indexing when
you log off - right when it's the best time to do some work because the
system is almost guaranteed to be idle, just sitting there waiting for a
new logon.

Running under the local system account, the indexer hass full access to all
local files except for encrypted ones, so it can keep indexing all the
time.

And as I said, indexing encrypted files poses a security risk.


There is something else however, that points towards using the user's
credentials as well: you can add UNC paths to network resources, but the
local system account can't access those (it can if you're in a domain and
the computer account has access, but never in a workgroup configuration).

Well, you was right.
-Zian

"Lucvdv" wrote:

> On Mon, 14 May 2007 23:40:01 -0700, Zian <Zian@discussions.microsoft.com>
> wrote:
>
> > That's an interesting point. I'd always thought the service inherited the
> > security token from the notification area app.
>
> I'm not saying that's exactly how it is, I was just giving it my best
> guess. Sorry if I made the impression that I'm an expert on the field
>
>
> But if it worked differently (i.e. using the credentials of the logged on
> user), that would practically mean the indexer has to stop indexing when
> you log off - right when it's the best time to do some work because the
> system is almost guaranteed to be idle, just sitting there waiting for a
> new logon.
>
> Running under the local system account, the indexer hass full access to all
> local files except for encrypted ones, so it can keep indexing all the
> time.
>
> And as I said, indexing encrypted files poses a security risk.
>
>
> There is something else however, that points towards using the user's
> credentials as well: you can add UNC paths to network resources, but the
> local system account can't access those (it can if you're in a domain and
> the computer account has access, but never in a workgroup configuration).
>