[计算机]EFS 故障恢复代理实战分步指南_ Knowledge Sharing.docVIP

设置及步骤=========在域环境中部署 EFS Recovery Agent 为了防止域用户的机器损坏,私钥丢失的情况我们需要在域的范围内部署 EFS Recovery Agent. 如下1. 在域环境中创建用户组, 如 “Recovery Agencies” 2. 在CA 上创建 新的 “EFS Recovery Agent” 的 template: 打开 Certification Authority 管理界面, 右键点击”Certificate Templates”( 文件夹 选择 “Manage”(  在证书模板管理界面中, 选择”EFS Recovery Agent”(  右键点击”EFS( Recovery Agent” , 选择”Duplicate Templates”  如下, 相应的Validity period( 可以修改然后选择 security 便签页,并允许 “Recovery Agencies” 用户组中的用户申请 在创建完成 新的 “File Replication Agent” 模板 后,将”Certificate( Templates” 管理界面关闭 在”Certification Authorities” 的 “Certificate Templates”( 中添加该新的证书模板. 如下 右键点击 右边的控制板, 选择 “New”( “Certificate Template to Issue”  随后关闭CA 管理界面.(在完成上述设置后, 属于”Recovery Agencies” 组的用户可以申请 File Recovery Agent 的证书, 如下 用该用户登陆域内的机器, 在该机器上运行certmgr.msc( 然后在 Personal store 中可以看到相应的证书生成.( 对于该 “recovery( agent” 用户的证书我们可以通过下面的办法来将该证书导出,并保存在安全的地方, 以备今后使用. Back up an EFS( certificate with the private key  Click Start , click Run , type( certmgr.msc , and then click OK .  In the console tree, go to the following( location, and then click Certificates :  Certificates - Current( User/Personal/Certificates  In the details pane, click the certificate that( has Encrypting File System listed in the Intended Purposes column.  On( the Action menu, point to All Tasks , and then click Export .  In the( Certificate Export Wizard, click Next , and then click Yes, export the private key.  Note This option appears only if the private key is marked as( exportable and if you have access to the private key.  Under Export File( Format , make sure that the Enable strong protection (requires IE 5.0, NT 4.0 SP4 or above) check box is selected, and then click Next .  In the Password( box, type a password to encrypt the private key that you are exporting, type the same password in the Confirm password box, and then click Next .  In the( File name box, type a file name and a path for the PKCS #12 file that will store the exported certificate and private key, click Next , and t