SMB/CIFS share of encrypted windows directory

Question

I have a windows 8.1 pro stand alone computer. It has one directory that is encrypted. This computer shares that directory and others with a linux computer. Just after the windows 8.1 computer reboots, linux is unable to access the encrypted directory, but
it can access other unencrypted directories. Once I log on the windows computer as a user with access to the encrypted directory, the linux computer is suddenly able access the encrypted folder. The linux computer can continue to access the encrypted directory
from linux after the user logs off the windows computer.
To be able to access the encrypted directory, I only need to log on to the windows console, i don't need to start any programs. It's as if windows cannot access some kind of key until the a user with access to the encrypted folder logs on to the windows
system from the console. I've tried many different linux command line options for opening the windows share and it doesn't seem to change the behavior. It is typically mounted with:
mount
-t cifs //192.168.1.2/efsdirectory ~/mnt --verbose -o rw,user=username,uid=1000,gid=1000
The behavior is identical if a directory above the efs directory is mounted.
I searched all of the windows event logs for errors from the failed access to the encrypted directory, but I don't see any.
Thanks for your help.

Answer 1

Hi,
Thanks for your help.
if all your systems are in Domain or not.
The windows and linux computers are not on a windows domain, just the same workgroup that is named "workgroup".
Also please help confirm if "encrypted" means encrypted by EFS (or Bitlocker).
The directory that i'm trying to access is encrypted with EFS. Since this is a desktop computer, it does not use bitlocker
What's the exact username here in your command? Is it the same account as the one you logged on Windows 8.1?
the username in the unix mount command is the same one used to log onto the windows system. The linux username is different, but that's specified in the mount command with the UID and GID.
The problem occurs after a full reboot, I have disabled the windows 8.1 fast reboot 'feature'.
I'll check tonight, but is it possible that the "Encrypting file system service" is not starting when I mount the drive? Perhaps it only starts when I log on. I noticed that this service is set to 'automatic' on another (windows 7) computer.
Here's a timeline of what happens:
1) Log off of the windows computer. Reboot. (not fast boot)
2)
mount drive on linux computer
3)  brouse directory structure on linux. Can open files that are not in encrypted directories. Cannot open files that are in encrypted directories.
4) log onto windows machine
5) brouse directory structure. Now I can open files that are in encrypted directories.
6) log off windows machine
7) brouse directory structure. I can still open files that are in encrypted directories.
Looking at the windows logs, I can see 2 login entries exactly when I mount the drive:
Special privileges
assigned to new logon.
Subject:
Security ID:   
HOSTNAME\USERNAME
Account Name:   
USERNAME
Account Domain:   
HOSTNAME
Logon ID:   
0x43C3B
Privileges:   
SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
An account was successfully
logged on.
Subject:
Security ID:   
NULL SID
Account Name:   
Account Domain:   
Logon ID:   
0x0
Logon Type:   
3
Impersonation Level:   
Impersonation
New Logon:
Security ID:   
HOSTNAME\USERNAME
Account Name:   
USERNAME
Account Domain:   
HOSTNAME
Logon ID:   
0x43C3B
Logon GUID:   
{00000000-0000-0000-0000-000000000000}
Process Information:
Process ID:   
0x0
Process Name:   
Network Information:
Workstation Name:   
Source Network Address:   
192.168.1.7
Source Port:   
58432
Detailed Authentication
Information:
Logon Process:   
NtLmSsp
Authentication Package:   
NTLM
Transited Services:   
Package Name (NTLM only):   
NTLM V2
Key Length:   
0
Thanks again.