www.BlackViper.com: Windows 7 Services 411 - Encrypting File System (EFS)

Encrypting File System (EFS)

Default Description:

Provides the core file encryption technology used to store encrypted files on NTFS file system volumes. If this service is stopped or disabled, applications will be unable to access encrypted files.

Additional Information:

None at this time.

Additional Reading:

• EFS: http://en.wikipedia.org/wiki/Encrypting_File_System

Discussion Topic Link:

Windows 7 Services Forum

Defaults Startup Type:

Windows 7 Starter: Manual
Windows 7 Home Basic: Manual
Windows 7 Home Premium: Manual
Windows 7 Professional: Manual
Windows 7 Ultimate: Manual
Windows 7 Enterprise: Manual

Other Settings:

Safe Setting: Manual

Service Names:

Service Name (registry): EFS

Display Name: Encrypting File System (EFS)

Default Path and Command Line Options:

C:\Windows\System32\lsass.exe

Log On As:

Account: Local System account

Dependencies:

What service Encrypting File System (EFS) needs to function properly:

• Remote Procedure Call (RPC) (S, HB, HP, P, U, E)
  • DCOM Server Process Launcher (S, HB, HP, P, U, E)
  • RPC Endpoint mapper (S, HB, HP, P, U, E)

What other service require Encrypting File System (EFS) to function properly:

• None (S, HB, HP, P, U, E)

Registry Settings (.reg):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\EFS]
"DisplayName"="@%SystemRoot%\\system32\\efssvc.dll,-100"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6c,\
00,73,00,61,00,73,00,73,00,2e,00,65,00,78,00,65,00,00,00
"Description"="@%SystemRoot%\\system32\\efssvc.dll,-101"
"ObjectName"="LocalSystem"
"ErrorControl"=dword:00000001
"Start"=dword:00000003
"Type"=dword:00000020
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00
"RequiredPrivileges"=hex(7):53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,\
00,6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,\
65,00,00,00,53,00,65,00,54,00,63,00,62,00,50,00,72,00,69,00,76,00,69,00,6c,\
00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,\
73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,00,72,00,69,00,76,00,69,00,6c,\
00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,73,00,73,00,69,00,67,00,6e,00,\
50,00,72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,6e,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,\
75,00,64,00,69,00,74,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\
00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\EFS\Security]
"Security"=hex:01,00,14,80,a0,00,00,00,ac,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,c0,14,00,02,00,0d,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,70,00,05,00,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,bf,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,9d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,14,00,9d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,14,00,14,00,\
00,00,01,01,00,00,00,00,00,05,0b,00,00,00,01,01,00,00,00,00,00,05,12,00,00,\
00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\EFS\TriggerInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\EFS\TriggerInfo\0]
"Type"=dword:00000014
"Action"=dword:00000001
"GUID"=hex:44,e6,63,68,5d,dd,a2,43,a8,b5,7a,81,b4,66,72,e6