{"id":1262,"date":"2018-01-26T13:47:33","date_gmt":"2018-01-26T13:47:33","guid":{"rendered":"http:\/\/help.sealionshipping.co.uk\/?p=1262"},"modified":"2018-01-26T13:47:33","modified_gmt":"2018-01-26T13:47:33","slug":"gtmailplus-server-2012-installation-prerequisite-efs-data-encryption","status":"publish","type":"post","link":"http:\/\/gardiner.tech\/bluebook\/blog\/2018\/01\/26\/gtmailplus-server-2012-installation-prerequisite-efs-data-encryption\/","title":{"rendered":"GTMailPlus – Server 2012 Installation Prerequisite – EFS DATA Encryption"},"content":{"rendered":"

\t\t\t\tOther than the .NET FRAMEWORK v4.6.2 prerequisite that needs to be installed on a Windows 2012 server, once \u00a0GTMailPlus \u00a0is installed you will need to enable EFS folder encryption<\/strong> on the MailBoxRepository folder located in the C:\\Encore folder or the Encore service (essential to mail transmission) will fail.<\/p>\n

Data Recovery Agent<\/strong>
\nNote that EFS requires a certificate and this is associated with the logged on user. In the case of the server that logged on user is the Administrator. In the event the server goes down the files in the folder will be locked and can only be opened with the correct certificate. \u00a0The Administrator is therefore the only EFS Data Recovery Agent. Any other user will need a copy of the key installed on their computer before the files can be opened. So it is good practice to export the key(s) and keep it\/them in a safe place just in case.<\/p>\n

 <\/p>\n

Step By Step Guide<\/span><\/p>\n

Create a New EFS Data Recovery Agent<\/strong>
\nOn the server go to Administration Tools,\u00a0 Group Policy Management
\nClick on the domain name and expand<\/p>\n

Right Click on Default Domain Policy object, Edit<\/p>\n

In the Group Policy Management Editor interface, click\u00a0Computer Configuratio<\/strong>n, expand\u00a0Policies<\/strong>,\u00a0expand\u00a0Windows Settings<\/strong>, expand\u00a0Security Settings<\/strong>, expand\u00a0Public Key Policies<\/strong>, and then click\u00a0Encrypting File System<\/strong>.<\/p>\n

Next,\u00a0right-click the Administrator certificate<\/strong>, and then click\u00a0Delete<\/strong>\u2026\u00a0 and confirm Delete. Click Yes<\/p>\n

In the Group Policy Management Editor,\u00a0right-click Encrypting File System<\/strong>, and then click\u00a0Create Data Recovery Agent<\/strong>\u2026
\nClose Group Policy Management Editor interface and Group Policy Management tool<\/p>\n

Next, open\u00a0Windows PowerShell<\/strong>\u00a0, then type\u00a0gpupdate \/force<\/strong>\u00a0and press Enter\u2026<\/p>\n


\nCreate the Data Recovery Agent Certificates
\n<\/strong>Now Go to Start, Run and type MMC press Enter
\nIn the Console1 interface, click File, and then click\u00a0Add\/Remove Snap-i<\/strong>n\u2026
\nIn the Add or Remove Snap-ins interface,\u00a0click\u00a0Certificates<\/strong>, and then click\u00a0Add<\/strong>\u2026
\nIn the Add Or Remove Snap-ins interface, click\u00a0OK<\/strong>\u2026
\nIn the left pane, expand\u00a0Certificates \u2013 Current Use<\/strong>r,\u00a0right-click Personal<\/strong>, click\u00a0All Tasks<\/strong>, and then\u00a0click\u00a0Request New Certificate<\/strong>\u2026
\nThe\u00a0Certificate Enrollment<\/strong>\u00a0interface pops up, click\u00a0Next<\/strong>\u2026
\nOn the\u00a0Select Certificate Enrollment Policy<\/strong>\u00a0interface, verify that you have\u00a0Active Directory Enrollment Policy<\/strong>, and then click Next\u2026
\nOn the Request Certificates interface, click\u00a0the\u00a0Basic EFS<\/strong>\u00a0check box, and then click\u00a0Enroll<\/strong>\u2026
\nOn the Certificate Installation Results interface, verify that the\u00a0Status : Succeeded<\/strong>\u00a0and then click\u00a0Finish<\/strong>\u2026
\nIn the Console1 interface, expand Certificates \u2013 Current User, expand Personal, and\u00a0then click Certificates, on the right pane verify that under issued to, your present Log in User Name is listed and verify also\u00a0that it was issued by\u00a0SERVERNAME
\n<\/span>Right click on the Administrator certificate, All Tasks, Export…
\nIn the Certificate Export Wizard click Next, select Yes export the private key. Next
\nPersonal Information Exchange – PKCS #12(.PFX) and check Include all certificates in certification path if possible. Next
\nCheck Password and enter password (sealion). Next
\nBrowse to a location and enter a filename (EFSkey) to save the .pfx file.<\/p>\n

If there is a second EFS Certificate – save that also<\/p>\n

 <\/p>\n

Enable EFS Encryption on MailBoxRepository folder<\/strong><\/p>\n

    \n
  1. Navigate to the GTMAIL’s MailRepository folder – C:\\Encore<\/li>\n
  2. Select MailBoxRepository – right click, Properties.<\/li>\n
  3. In the General tab – select Advanced button<\/li>\n
  4. Check Encrypt contents to secure data. OK<\/li>\n
  5. In the General tab – click Apply<\/li>\n<\/ol>\n

    NB: If enabled (Folder Options, View – check Show encrypted or compressed files in colour) you will see the folder and any files within coloured green (Windows 10 has this off by default. For Windows Server 2012 it is on)<\/p>\n

     <\/p>\n

    References<\/strong><\/p>\n

    Step by Step : Encrypting User Data with EFS in Windows Server 2012 R2<\/a><\/p>\n

    http:\/\/windowsitpro.com\/security\/fast-way-find-efs-folders-and-files<\/a><\/p>\n

    https:\/\/www.nextofwindows.com\/how-to-check-a-pfx-certifications-expiry-date-on-windows<\/a><\/p>\n

    EncryptionFilesystem<\/a><\/p>\n

     \t\t<\/p>\n","protected":false},"excerpt":{"rendered":"

    Other than the .NET FRAMEWORK v4.6.2 prerequisite that needs to be installed on a Windows 2012 server, once \u00a0GTMailPlus \u00a0is installed you will need to enable EFS folder encryption on the MailBoxRepository folder located in the C:\\Encore folder or the Encore service (essential to mail transmission) will fail. Data Recovery Agent Note that EFS requires a certificate and this is associated with the logged on user. In the case of the server that logged on […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[23,75],"tags":[109,127,129,151,153,155],"_links":{"self":[{"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/posts\/1262"}],"collection":[{"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/comments?post=1262"}],"version-history":[{"count":0,"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/posts\/1262\/revisions"}],"wp:attachment":[{"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/media?parent=1262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/categories?post=1262"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/tags?post=1262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}