EFS in Teams on Network Shares

Hi,

today I have found a great article about productive usage of EFS in teams. I mean everyone who have ever tried to use EFS in a multi-user environment may have seen the same unbelievable shortcomings: SMB EFS works with server based profiles with a bunch of issues as a result of this concept. And even with WebDAV there is still a major issue: multi-user server shares with EFS will not work because you can't inherit the EFS "ACL" and a new file will only be decryptable by the file owner. No comment.

Well, here's the link:
http://geisbauer.blogspot.com/2008/06/sharepoint-dateien-verschlsseln-teil-1.html
http://geisbauer.blogspot.com/2008/06/sharepoint-dateien-verschlsseln-teil-2.html

But sorry... it's in German. Maybe some of you folks can read it?

Joelle

WebDAV Redirector Registry Settings

In Windows Vista and Windows Server 2008 there is an updated WebDAV redirector which has several settings available through registry.

Rober McMurray has documented all currently available settings in his blog, it's a great resource and I have to copy it especially for my own memory.

The base registry hive is:
HKLM\SYSTEM\CurrentControlSet\Services\WebClient\Parameters

The know settings are:

Value & Description	Type	Values	Default
AcceptOfficeAndTahoeServers Specifies whether the WebClient service can connect to web sites that are running SharePoint or Office Web Server.	DWORD	0 = False 1 = True	1
BasicAuthLevel Specifies whether the WebClient service can use basic authentication to talk to a server. Note: Using basic authentication can cause serious security issues as the username/password are transmitted in clear text, therefore the use of basic authentication over WebDAV is disabled by default unless the connection is using SSL. That being said, this registry key can override the default basic authentication behavior, but it is still strongly discouraged.	DWORD	0 = Basic authentication is disabled 1 = Basic authentication is enabled for SSL web sites only 2 = Basic authentication is enabled for SSL and non-SSL web sites	1
FileAttributesLimitInBytes Specifies the maximum size that is allowed by the WebClient service for all properties on a specific collection.	DWORD	Size of attributes in bytes	1,000,000 decimal (1 MB)
FileSizeLimitInBytes Specifies the maximum size in bytes that the WebClient service allows for file transfers.	DWORD	File size in bytes	50,000,000 decimal (50 MB)
InternetServerTimeoutInSec Specifies the connection timeout for the WebClient service uses when communicating with non-local WebDAV servers.	DWORD	Time in seconds	30 decimal
LocalServerTimeoutInSec Specifies the connection timeout for the WebClient service uses when communicating with a local WebDAV server.	DWORD	Time in seconds	15 decimal
SendReceiveTimeoutInSec Specifies the timeout in seconds that WebDAV the WebClient service uses after issuing a request, such as “GET /file.ext” or “PUT /file.ext”.	DWORD	Time in seconds	60 decimal
ServerNotFoundCacheLifeTimeInSec Specifies the period of time that a server is cached as non-WebDAV by the WebClient service. Note: The WebClient service maintains a list of non-WebDAV servers that have been contacted. If the server is found in this list, a fail is returned immediately without attempting to contact the server.	DWORD	Time in seconds	60 decimal
SupportLocking Specifies whether the WebClient service supports locking.	DWORD	0 = False 1 = True	1

Note: After changing any of these settings you will need to restart the WebClient service.

Source: Robert McMurray's Blog

Great Microsoft EFS articles and tools

Microsoft EFS (Encrypted File System) can be used in combination with SMB and WebDAV. With SMB on network shares it makes not much sense (see my other notes) because of the strange implementation of using server side profiles and keys. But on local disks or with WebDAV on network filestores it's a great security enhancement out-of-the-box.

But there are a lot of issues and caveats you have to know when you want to deploy EFS in an enterprise infrastructure. Today I found the "ParanoidMike" blog which is a great resource for some of EFS related question:

EFS Certificate Updater
EFS and SYSKEY backgrounder
Why EFS makes no sense on servers

Source: ParanoidMike

Mounting WebDAV Servers (RFC 4709)

Found this RFC today. Well, it's an October 2006 document, I am sorry if this is old news for you :-).

RFC 4709

It's Julian Rescke (greenbytes) again and he does a good job in not only describing an WebDAV announcement technology already used by SAP and others but also included some Windows client script to make the transparent mounting work in any native Windows environment.

Worth looking into because if you plan an infrastructure where WebDAV is used instead of file servers it is a real need to think about a link notation which does not result in the well known "browser view" of WebDAV shares but instead opens an explorer view of the data. Julian's document describes such a way.

On the other hand at least in Windows Vista it is possible to use a file share URL to connect to WebDAV:

\\server.domain@SSL\DavWWWRoot

I will try to collect some more pros and cons about the different ways to mount a WebDAV share - happy about your comments.

Windows Server 2008, the storage story

On the Windows Server Division Weblog, Claude Lorenson is writing about "the future of SMB". He delivers some very interesting details about Windows Server 2008 (Longhorn) and the new features of SMB 2.0. It's obvious that Microsoft invests in SMB, especially to make it usable for the loosely coupled branch offfice scenarios:

SMB 2.0 greatly improves the scalability of SMB 1.0; there is now more open files on a server supported as well as a higher number of shares supported. The protocols have been enhanced to reduce the “chattiness” that makes file sharing on a WAN sometimes painful. With SMB 2.0, customer data has shown the ability to download a 300MB file 35 times faster than with SMB 1.0 using a 100 Mbps link (from 24 minutes to 41 seconds). SMB2.0 will also support transactions, symbolic links and client side encryption. All these features are fully functional when Vista clients are used in combination with Windows Server 2008.

But there is also an important side note which may change a lot when planning next generation storage infrastructures:

The following sentence: "SMB2.0 will also support transactions, symbolic links and client side encryption" is not correct. Transaction support and client side encryption will not be available in Windows Server 2008 and therefore are not in the beta 3 release either.]

Wow... still no SMB encryption. I remember Microsoft is promising this feature since the late 90's. It looks like WebDAV will continue to be the only native file access protocol in Windows Clients which support communication encryption.

See the full story here:
Windows Server 2008, the storage story

Microsoft White Paper: Understanding and Troubleshooting Sharepoint Explorer View

Well, ever thought about the strange behaviors in working with Sharepoint when connecting with Windows Explorer, WebDAV, Applications File Dialog, etc?

This White Paper explains a lot:

The Explorer View feature that is included with Windows SharePoint Services and is also available in Microsoft SharePoint Portal Server lets users access files stored in the SharePoint database using the familiar Windows Explorer interface. To the end user, this appears to be a very simple and robust feature. In reality, it is the result of a complex series of interactions between many individual components provided by separate Microsoft products.

This white paper is an effort to accomplish three things:

• Provide an overview of the Explorer View architecture.

• Document the causes and resolutions of problems you are likely to encounter when using the Explorer View in a corporate environment.

• Describe basic troubleshooting steps to be performed before engaging Microsoft Customer Support Services (CSS).

Everyone working with WebDAV and/or Sharepoint should have a look into this paper - it may solve some of your day by day problems.

Source:
http://www.microsoft.com/downloads

Mirosoft WebDAV DLL and Redirector Versions and Issues

A small German based company (greenbytes, one of the owners is included in some of the WebDAV RFCs) has done a terrific job in collecting all kind of informations about the MSDAIPP.DLL (Web Folder Client) and the MRXDAV.SYS (WebDAV Mini-Redirector).

You can find all Windows and Hotfix Versions of these files and links to all available Microsoft KB-Articles and documents related.

Give it a try:

Web Folder Client (MSDAIPP.DLL) Versions and Issues List
http://greenbytes.de/tech/webdav/webfolder-client-list.html

WebDAV Mini-Redirector (MRXDAV.SYS) Versions and Issues List
http://greenbytes.de/tech/webdav/webdav-redirector-list.html