Great Microsoft EFS articles and tools

Microsoft EFS (Encrypted File System) can be used in combination with SMB and WebDAV. With SMB on network shares it makes not much sense (see my other notes) because of the strange implementation of using server side profiles and keys. But on local disks or with WebDAV on network filestores it's a great security enhancement out-of-the-box.

But there are a lot of issues and caveats you have to know when you want to deploy EFS in an enterprise infrastructure. Today I found the "ParanoidMike" blog which is a great resource for some of EFS related question:

EFS Certificate Updater
EFS and SYSKEY backgrounder
Why EFS makes no sense on servers

Source: ParanoidMike

Mounting WebDAV Servers (RFC 4709)

Found this RFC today. Well, it's an October 2006 document, I am sorry if this is old news for you :-).

RFC 4709

It's Julian Rescke (greenbytes) again and he does a good job in not only describing an WebDAV announcement technology already used by SAP and others but also included some Windows client script to make the transparent mounting work in any native Windows environment.

Worth looking into because if you plan an infrastructure where WebDAV is used instead of file servers it is a real need to think about a link notation which does not result in the well known "browser view" of WebDAV shares but instead opens an explorer view of the data. Julian's document describes such a way.

On the other hand at least in Windows Vista it is possible to use a file share URL to connect to WebDAV:

\\server.domain@SSL\DavWWWRoot

I will try to collect some more pros and cons about the different ways to mount a WebDAV share - happy about your comments.

Windows Server 2008, the storage story

On the Windows Server Division Weblog, Claude Lorenson is writing about "the future of SMB". He delivers some very interesting details about Windows Server 2008 (Longhorn) and the new features of SMB 2.0. It's obvious that Microsoft invests in SMB, especially to make it usable for the loosely coupled branch offfice scenarios:

SMB 2.0 greatly improves the scalability of SMB 1.0; there is now more open files on a server supported as well as a higher number of shares supported. The protocols have been enhanced to reduce the “chattiness” that makes file sharing on a WAN sometimes painful. With SMB 2.0, customer data has shown the ability to download a 300MB file 35 times faster than with SMB 1.0 using a 100 Mbps link (from 24 minutes to 41 seconds). SMB2.0 will also support transactions, symbolic links and client side encryption. All these features are fully functional when Vista clients are used in combination with Windows Server 2008.

But there is also an important side note which may change a lot when planning next generation storage infrastructures:

The following sentence: "SMB2.0 will also support transactions, symbolic links and client side encryption" is not correct. Transaction support and client side encryption will not be available in Windows Server 2008 and therefore are not in the beta 3 release either.]

Wow... still no SMB encryption. I remember Microsoft is promising this feature since the late 90's. It looks like WebDAV will continue to be the only native file access protocol in Windows Clients which support communication encryption.

See the full story here:
Windows Server 2008, the storage story

Microsoft White Paper: Understanding and Troubleshooting Sharepoint Explorer View

Well, ever thought about the strange behaviors in working with Sharepoint when connecting with Windows Explorer, WebDAV, Applications File Dialog, etc?

This White Paper explains a lot:

The Explorer View feature that is included with Windows SharePoint Services and is also available in Microsoft SharePoint Portal Server lets users access files stored in the SharePoint database using the familiar Windows Explorer interface. To the end user, this appears to be a very simple and robust feature. In reality, it is the result of a complex series of interactions between many individual components provided by separate Microsoft products.

This white paper is an effort to accomplish three things:

• Provide an overview of the Explorer View architecture.

• Document the causes and resolutions of problems you are likely to encounter when using the Explorer View in a corporate environment.

• Describe basic troubleshooting steps to be performed before engaging Microsoft Customer Support Services (CSS).

Everyone working with WebDAV and/or Sharepoint should have a look into this paper - it may solve some of your day by day problems.

Source:
http://www.microsoft.com/downloads

Mirosoft WebDAV DLL and Redirector Versions and Issues

A small German based company (greenbytes, one of the owners is included in some of the WebDAV RFCs) has done a terrific job in collecting all kind of informations about the MSDAIPP.DLL (Web Folder Client) and the MRXDAV.SYS (WebDAV Mini-Redirector).

You can find all Windows and Hotfix Versions of these files and links to all available Microsoft KB-Articles and documents related.

Give it a try:

Web Folder Client (MSDAIPP.DLL) Versions and Issues List
http://greenbytes.de/tech/webdav/webfolder-client-list.html

WebDAV Mini-Redirector (MRXDAV.SYS) Versions and Issues List
http://greenbytes.de/tech/webdav/webdav-redirector-list.html

DavCopy - The WebDAV robocopy edition

This one is a must have for everyone working with native WebDAV or Sharepoint as a WebDAV Server:

DavCopy
http://www.bluedoglimited.com/Downloads/default.aspx

It's a kind of xcopy / robocopy for WebDAV, you can do simple thins like

DavCopy.exe test\folder\readme.doc “http://server.com/shared documents/”

or funny things like

/s /xf *docs\*c* w* /xd reports how-to lang

and most important, it supports command line authentication for batch jobs.

Microsoft WebDAV Hotfix - KB 933771

Last one for today - this one is really ugly: Microsoft Windows Vista crashes when using encryption with WebDAV. Sometimes I wonder about the quality of test procedures at Microsoft - based on several good articles found on microsoft.com WebDAV is the preferred protocol to work work securely against file servers because it is the only protocol offered by Microsoft which encrypts the communication over the network - in addition to the encrypted EFS files.

But it seems no one cared - copy one small EFS-encrypted file to a WebDAV share says goodby to your Explorer.

Details:

In Windows Vista, the Svchost.exe process stops responding when you try to copy encrypted Encrypting File System (EFS) files to a Web Distributed Authoring and Versioning (WebDAV) resource. If you use Windows Explorer to do this, Windows Explorer stops responding. You may have to restart the computer.

Note The Svchost.exe process hosts the WebClient service.

When you try to save an encrypted 2007 Microsoft Office document to a WebDAV resource, you may receive an error message that says that the document cannot be saved.

The KB Article can be found here:
http://support.microsoft.com/kb/933771