----- Original Message -----
Sent: Thursday, January 05, 2006 7:14
AM
Subject: [ActiveDir] [OT] Generating EFS
Recovery Certificate
Sorry for the off topic question. Here is the
background...
Remember when you first bring up a DC and it
generates a self-signed EFS Recovery Certificate? Well what do you do when you
don't know about that and 5 years down the road you want to implement a
recovery solution and that original DC is long gone?
Well one way would be you can use Cipher.exe to
generate another EFS Recovery cert and create a domain recovery agent using
that cert and re-touch all your encrypted files across each PC.
Great, no biggie. But let's say you want to put
the this cert on a secure USB key fob, so it's cant be copied off or tampered
with but your unnamed vendor doesn't support certs that are issued out for 100
years.
So basically I need another way to generate a EFS
Recovery Certificate that doesn't go out for 100yr, I'd like to control the
issuing date. Does anyone know another way to go about this? It is unknown to
me if I can use the Crypto API to generate a self-signed cert with whatever
the EFS Recovery OID is. Thanks again for any input!
-Brandon
