Why am I getting EFS Backup Message?

I have been getting a request to backup but have never encrypted anything.
This
is verified using the "cipher /n /u" command. It showed no files. Yet, if I
look in Certificate Manager, there is indeed a cerificate for me for EFS. It
shows an expiration of 11/18/2106. I assume this means it was created on
11/18/2006.

I get this backup notice each time I log on. I will backup to get rid of
this message but am clueless why it just started coming up in the last 2-3
days.

I am using Vista Ultimate (x86) and installed the OS on 11/2/2006.

I really would like to understand why this is happening. The only thing I
can see that might somehow be related is my installation of Windows Live
OneCare on 11/17 and first Tune-Up on 11/18.

Does anyone know what might be happening here?

Thanks.

What other software have you installed recently? Any Office 2007? Groove?
Pretty sure that the certificate was created by Groove. If not, then I'm
stumped.

--
Jane, not plain 64 bit enabled :-)
Batteries not included. Braincell on vacation ;-)
"John A. Gallagher" <jgallagher11@hotmail.com> wrote in message
news:%23kjKT1xHHHA.2456@TK2MSFTNGP06.phx.gbl...
>I have been getting a request to backup but have never encrypted anything.
>This
> is verified using the "cipher /n /u" command. It showed no files. Yet, if
> I
> look in Certificate Manager, there is indeed a cerificate for me for EFS.
> It
> shows an expiration of 11/18/2106. I assume this means it was created on
> 11/18/2006.
>
> I get this backup notice each time I log on. I will backup to get rid of
> this message but am clueless why it just started coming up in the last 2-3
> days.
>
> I am using Vista Ultimate (x86) and installed the OS on 11/2/2006.
>
> I really would like to understand why this is happening. The only thing I
> can see that might somehow be related is my installation of Windows Live
> OneCare on 11/17 and first Tune-Up on 11/18.
>
> Does anyone know what might be happening here?
>
> Thanks.

First - let me say great signature.

I did install Office 2007 (including Groove) - but on 11/17 - not 11/18. I
guess it is the answer though.

A further question: when you back up, which parameters are advisable? I
noticed there was a default but it had a couple of unchecked items under it.

Thanks for the response.

"Jane C" <jellybean@NOSPAMxjgarage.org> wrote in message
news:47B4A575-8187-47DB-9B53-4802D8D11178@microsoft.com...
> What other software have you installed recently? Any Office 2007?
> Groove? Pretty sure that the certificate was created by Groove. If not,
> then I'm stumped.
>
> --
> Jane, not plain 64 bit enabled :-)
> Batteries not included. Braincell on vacation ;-)
> "John A. Gallagher" <jgallagher11@hotmail.com> wrote in message
> news:%23kjKT1xHHHA.2456@TK2MSFTNGP06.phx.gbl...
>>I have been getting a request to backup but have never encrypted
>>anything. This
>> is verified using the "cipher /n /u" command. It showed no files. Yet, if
>> I
>> look in Certificate Manager, there is indeed a cerificate for me for EFS.
>> It
>> shows an expiration of 11/18/2106. I assume this means it was created on
>> 11/18/2006.
>>
>> I get this backup notice each time I log on. I will backup to get rid of
>> this message but am clueless why it just started coming up in the last
>> 2-3
>> days.
>>
>> I am using Vista Ultimate (x86) and installed the OS on 11/2/2006.
>>
>> I really would like to understand why this is happening. The only thing I
>> can see that might somehow be related is my installation of Windows Live
>> OneCare on 11/17 and first Tune-Up on 11/18.
>>
>> Does anyone know what might be happening here?
>>
>> Thanks.
>

The exact time when the certificate was created might yield more clues.
The first place would that in be in the Certificate Manager there might be a range:

Valid From 11/18/2006 to 11/18/2106

Then also look at the details tab - more data here.

Also, you could look at the file itself.

You would find it in ( I think):
\users\<username>\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\
and there should be a file with that timestamp.

Or you could look in
\users\<username>\AppData\Roaming\Microsoft\Crypto\RSA\<sid>\

For the raw key itself.

The created date will give you the time when the key was created.

Nik

If you are backing up the certificate through the EFS balloon/prompt/wizard,
there is no need to select options. The default settings are all that you
need. If you are backing up the certificate from Certificate Manager's
Export Wizard, be sure to select "Yes, export the private key." It's best to
store the backup (the .pfx file) on removable media in a safe location and do
not encrypt that file. The EFS balloon will go away after three logons if
you make no selections in the prompt or if you choose to not back up (not
recommended).

To determine the date that the first encryption occurred, open the
certificate in Certificate Manager and click on the Details tab. It will
have the "Valid from" date in the listview. That is the date the certificate
was created. Perhaps you can recall what occurred on that date that might
have done an encrypt operation. The only other "under the covers" encrypt
operation that we know of is when "Encrypt your offline files" is enabled.

Thanks.
Pat
--
This posting is provided "AS IS" with no warranties, and confers no rights.


"John A. Gallagher" wrote:

> First - let me say great signature.
>
> I did install Office 2007 (including Groove) - but on 11/17 - not 11/18. I
> guess it is the answer though.
>
> A further question: when you back up, which parameters are advisable? I
> noticed there was a default but it had a couple of unchecked items under it.
>
> Thanks for the response.
>
> "Jane C" <jellybean@NOSPAMxjgarage.org> wrote in message
> news:47B4A575-8187-47DB-9B53-4802D8D11178@microsoft.com...
> > What other software have you installed recently? Any Office 2007?
> > Groove? Pretty sure that the certificate was created by Groove. If not,
> > then I'm stumped.
> >
> > --
> > Jane, not plain 64 bit enabled :-)
> > Batteries not included. Braincell on vacation ;-)
> > "John A. Gallagher" <jgallagher11@hotmail.com> wrote in message
> > news:%23kjKT1xHHHA.2456@TK2MSFTNGP06.phx.gbl...
> >>I have been getting a request to backup but have never encrypted
> >>anything. This
> >> is verified using the "cipher /n /u" command. It showed no files. Yet, if
> >> I
> >> look in Certificate Manager, there is indeed a cerificate for me for EFS.
> >> It
> >> shows an expiration of 11/18/2106. I assume this means it was created on
> >> 11/18/2006.
> >>
> >> I get this backup notice each time I log on. I will backup to get rid of
> >> this message but am clueless why it just started coming up in the last
> >> 2-3
> >> days.
> >>
> >> I am using Vista Ultimate (x86) and installed the OS on 11/2/2006.
> >>
> >> I really would like to understand why this is happening. The only thing I
> >> can see that might somehow be related is my installation of Windows Live
> >> OneCare on 11/17 and first Tune-Up on 11/18.
> >>
> >> Does anyone know what might be happening here?
> >>
> >> Thanks.
> >
>
>

Could you also run "cipher /u /n /h" in case the encrypted files may be
hidden? This might provide a clue.

Thanks.
Pat
--
This posting is provided "AS IS" with no warranties, and confers no rights.


"John A. Gallagher" wrote:

> I have been getting a request to backup but have never encrypted anything.
> This
> is verified using the "cipher /n /u" command. It showed no files. Yet, if I
> look in Certificate Manager, there is indeed a cerificate for me for EFS. It
> shows an expiration of 11/18/2106. I assume this means it was created on
> 11/18/2006.
>
> I get this backup notice each time I log on. I will backup to get rid of
> this message but am clueless why it just started coming up in the last 2-3
> days.
>
> I am using Vista Ultimate (x86) and installed the OS on 11/2/2006.
>
> I really would like to understand why this is happening. The only thing I
> can see that might somehow be related is my installation of Windows Live
> OneCare on 11/17 and first Tune-Up on 11/18.
>
> Does anyone know what might be happening here?
>
> Thanks.
>
>

Pat -

Still nada.

I ran the backup but I was curious why I even had to.

A previous answer from Jane C. suggests it is due to setting up Groove 2007
on my machine (although all I did was install).

John

"Pat Hoffer [MSFT]" <pathoff@online.microsoft.com> wrote in message
news:5543422F-0ABD-4813-BC19-9DABC7596678@microsoft.com...
> Could you also run "cipher /u /n /h" in case the encrypted files may be
> hidden? This might provide a clue.
>
> Thanks.
> Pat
> --
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
>
> "John A. Gallagher" wrote:
>
>> I have been getting a request to backup but have never encrypted
>> anything.
>> This
>> is verified using the "cipher /n /u" command. It showed no files. Yet, if
>> I
>> look in Certificate Manager, there is indeed a cerificate for me for EFS.
>> It
>> shows an expiration of 11/18/2106. I assume this means it was created on
>> 11/18/2006.
>>
>> I get this backup notice each time I log on. I will backup to get rid of
>> this message but am clueless why it just started coming up in the last
>> 2-3
>> days.
>>
>> I am using Vista Ultimate (x86) and installed the OS on 11/2/2006.
>>
>> I really would like to understand why this is happening. The only thing I
>> can see that might somehow be related is my installation of Windows Live
>> OneCare on 11/17 and first Tune-Up on 11/18.
>>
>> Does anyone know what might be happening here?
>>
>> Thanks.
>>
>>

I believe I read that the built-in indexing for search keeps its files
encrypted, which is a good thing. It may be those index files, which unless
you go look for them, probably aren't showing up.

Knox



"John A. Gallagher" <jgallagher11@hotmail.com> wrote in message
news:%23kjKT1xHHHA.2456@TK2MSFTNGP06.phx.gbl...
>I have been getting a request to backup but have never encrypted anything.
>This
> is verified using the "cipher /n /u" command. It showed no files. Yet, if
> I
> look in Certificate Manager, there is indeed a cerificate for me for EFS.
> It
> shows an expiration of 11/18/2106. I assume this means it was created on
> 11/18/2006.
>
> I get this backup notice each time I log on. I will backup to get rid of
> this message but am clueless why it just started coming up in the last 2-3
> days.
>
> I am using Vista Ultimate (x86) and installed the OS on 11/2/2006.
>
> I really would like to understand why this is happening. The only thing I
> can see that might somehow be related is my installation of Windows Live
> OneCare on 11/17 and first Tune-Up on 11/18.
>
> Does anyone know what might be happening here?
>
> Thanks.