How to enable debug logs for EFS to trace EFS decrypting?
-
Friday, June 08, 2012 3:56 AM
Friends,
We are have window 7 Professional, we have configured EFS for user by logon script, We need to enable debug logging in windows 7 to trace, if user attempt to decrypt files.
Please help me to enable debug log in windows 7 Professional.
Addition info:
I have referred the URL : http://blogs.msdn.com/b/spatdsg/archive/2007/08/07/is-there-any-debug-logs-or-tracing-logs-can-help-us-to-monitor-certificate-importing-or-efs-decrypting.aspx
We have tried to enable debug logs by referring the above url in our window 7 system, But "Encrypting File System" folder is not shown under "Application and service logs"
Please help me to resolve.
Regards, Mohan - Technology
All Replies
-
Monday, June 11, 2012 5:47 AMModerator
Hi,
In Windows 7, please navigate to Application and Services Logs -> Microsoft -> Windows -> EFS -> Debug.
If you cannot find the log, please click Create Custom View in the right pane (Actions pane), then filter by source, select EFS in the list.
Niki Han
TechNet Community Support
- Marked As Answer by Niki HanMicrosoft Contingent Staff, Moderator Tuesday, June 19, 2012 3:57 AM
- Unmarked As Answer by Niki HanMicrosoft Contingent Staff, Moderator Tuesday, June 19, 2012 3:57 AM
- Marked As Answer by Mohan_technology Thursday, June 21, 2012 4:17 PM
-
Thursday, June 14, 2012 10:10 PM
Hi,
In Windows 7, please navigate to Application and Services Logs -> Microsoft -> Windows -> EFS -> Debug.
If you cannot find the log, please click Create Custom View in the right pane (Actions pane), then filter by source, select EFS in the list.
Niki,
I followed your tip and created the custom log. I then went and encrypted and decrytped a few folders. The log is still empty. Any ideas?
Thanks,
Dan K. -
Tuesday, June 19, 2012 4:02 AMModeratorDid you enable the Debug log? Right click Dedug and select enable.
Niki Han
TechNet Community Support
-
Thursday, June 21, 2012 4:17 PM
Hi Friends,
EFS Logging is works well, but only things i observed is same event id is logged for both encrypt and decrypt action.
Thanks for your support
Regards, Mohan - Technology
.png)
