Posts made by Texkonc

Logged into old profile and looked at the recovery details. But strange it only worked correctly for some

Checked into the Hyatt relaxing before spiceleader shindig

But no software was used yet.

@reid-cooper said in De-crypt EFS Files:

Did you end up trying out some decryption software?

I did what I could, got some recovered, but not all. Left detailed notes in the ticket while I’m at spiceworld, they (other techs) have a little under a week to get the rest recovered while I’m gone.

@scottalanmiller said in What Are You Doing Right Now:

Morning meetings shortly

On a Sunday?

@nerdydad said in What Are You Doing Right Now:

Not going to SW this year. Instead, sending the boss and @BluGhost23. I've already told him to catch up with @scottalanmiller and @JaredBusch and barrage y'all with questions.

Today was another soccer game follows by a full day of installing a 65W Yaesu radio into my Dad-in-law's truck. Was able to get out about 35-40 miles on 2m.

Night capped it by installing nginx onto Debian 9.1 on Qemu/KVM on Fedora 26. Next will be installing UCRM and unms, then Tar the server.

I don’t scott is going due to his new job

I’m packed and ready, granted only few hour drive for me.

@scottalanmiller said in What Are You Drinking:

Because some of us have a problem

@scottalanmiller said in What Are You Doing Right Now:

Antsle ad on my Facebook feed. Again... FB doesn't know me AT ALL.

Its all over my feed too.

I have tried many different methods today logging her machine into the old domain, the program that was used ProfWiz, moved the certs I was able to copy them back. Still no luck after many tries.

EFS wasn't setup with GPO for the whole domain, it was done by user alone. Single machine.
Cant export the private key.....This is in the default domain policy. No other machine have encrpyted files, this is just there for recovery.
I am logged into the old DC as the said user in the screenshot and trying to decrypt data the user put on a shared drive that it was copied off of, still get access denied.

@tim_g said in De-crypt EFS Files:

@texkonc said in De-crypt EFS Files:

@tim_g said in De-crypt EFS Files:

https://technet.microsoft.com/en-us/library/cc512680.aspx

if we had access to the old profile, sure.

If anyone in the domain encrypts something, and loses their key, the Domain Admin account can decrypt it. That's what I'm talking about. Or anyone if they install the cert.

It's saved users here a few times.

Different domain name, machine is joined to the new domain name, logged in as the new domain name, old DC is offline.
If I power up the old DC, hopefully I would be able to copy the files to the DC to decrypt them?

@tim_g said in De-crypt EFS Files:

https://technet.microsoft.com/en-us/library/cc512680.aspx

if we had access to the old profile, sure.

@scottalanmiller said in De-crypt EFS Files:

So the issue is that they lost their password / key and now want to hack in? NEver tried that, in theory software like that will work but might take years or decades to get in.

Something like that yeah.
I am building a Test VM to copy the data to and let the software run since I am sure the user might not like having it run for days killing the performance of her machine.

Anyone used https://www.elcomsoft.com/aefsdr.html ?

I have a customer that moved windows profile and we have no access to the old windows profile and she had folders that were encrypted using EFS. I can see the files are Green and when trying to open we get denied error, and trying to uncheck the EFS box for that file or folder says denied too. Has anyone had any luck with software trying to unlocked the EFS files ? We are willing to pay for software (within reason) if it will save us hours and hours of work.

The reason is we moved them to a new domain and of course it means a new windows login and the tech didn't know she had EFS files, and booting up the old domain and trying to login on her machine with the old login is not possible. Hence why we are looking for something to save our bacon.

@scottalanmiller said in What Are You Doing Right Now:

@texkonc said in What Are You Doing Right Now:

@dustinb3403 said in What Are You Doing Right Now:

@texkonc said in What Are You Doing Right Now:

found

2tb disks

What is this running on?

Arrary on a MD1000 attached to a R720 for backups. Veeam backups.
Repository for 2 primary Esxi nodes and veeam replicating the vm's to another cluster for DR.
They are not using all of ESXi to the potential and they don't have the work loads to support ESXi.
Found out today HA was on, but not working properly. Fixed that.
Not using DRS.
Not using Resource Pools.
Lots of drive issues today.
Working with them to get them on HyperV.
Two nodes with a SAN setup....Don't go there, I know....

This job keeps sounding like so much fun.

Joys you find at clients working for an MSP. If I would have been involved I would have had some choice words.

@dustinb3403 said in What Are You Doing Right Now:

@texkonc said in What Are You Doing Right Now:

found

2tb disks

What is this running on?

Arrary on a MD1000 attached to a R720 for backups. Veeam backups.
Repository for 2 primary Esxi nodes and veeam replicating the vm's to another cluster for DR.
They are not using all of ESXi to the potential and they don't have the work loads to support ESXi.
Found out today HA was on, but not working properly. Fixed that.
Not using DRS.
Not using Resource Pools.
Lots of drive issues today.
Working with them to get them on HyperV.
Two nodes with a SAN setup....Don't go there, I know....

found

2tb disks

Installed Mint on my old ASUS Transformer laptop that seemed to chew on win10. Prefect for an around the house laptop to just browse the interwebs.