Revision Summary Date Revision History Revision Class Comments 3/2/2007 1.0 New Version 1.0 release 4/3/2007 1.1 Minor Version 1.1 release 5/11/2007 1.2 Minor Version 1.2 release 6/1/2007 1.2.1 Editorial Changed language and formatting in the technical content. 7/3/2007 1.3 Minor Clarified the meaning of the technical content. 8/10/2007 2.0 Major Updated and revised the technical content. 9/28/2007 3.0 Major Converted to unified format. 10/23/2007 3.1 Clarified the meaning of the technical content. 1/25/2008 3.1.1 Editorial Changed language and formatting in the technical content. 3/14/2008 3.1.2 Editorial Changed language and formatting in the technical content. 6/20/2008 4.0 Major Updated and revised the
technical content. 7/25/2008 4.0.1 Editorial Changed language and formatting in the technical content. 8/29/2008 4.0.2 Editorial Changed language and formatting in the technical content. 10/24/2008 4.0.3 Editorial Changed language and formatting in the technical content. 12/5/2008 5.0 Major Updated and revised the technical content. 1/16/2009 5.0.1 Editorial Changed language and formatting in the technical content. 2/27/2009 5.0.2 Editorial Changed language and formatting in the technical content. 4/10/2009 5.0.3 Editorial Changed language and formatting in the technical content. 5/22/2009 6.0 Major Updated and revised the technical content.
7/2/2009 6.0.1 Editorial Changed language and formatting in the technical content. 8/14/2009 6.0.2 Editorial Changed language and formatting in the technical content. 9/25/2009 7.0 Updated and revised the technical content. 11/6/2009 8.0 Major Updated and revised the technical content. 12/18/2009 9.0 Major Updated and revised the technical content. 1/29/2010 10.0 Major Updated and revised the technical content. 3/12/2010 11.0 Major Updated and revised the technical content. 4/23/2010 11.0.1 Editorial Changed language and formatting in the technical content. 6/4/2010 12.0 Major Updated and revised the technical content. 7/16/2010 13.0 Major Updated and revised
technical content. 9/23/2011 18.0 Updated and revised the technical content. 12/16/2011 19.0 Major Updated and revised the technical content. 3/30/2012 19.0 None No changes to the meaning, language, or formatting of the technical content. 7/12/2012 19.0 None No changes to the meaning, language, or formatting of the technical content. 10/25/2012 20.0 Major Updated and revised the technical content. 1/31/2013 20.0 None No changes to the meaning, language, or formatting of the technical content. 8/8/2013 21.0 Major Updated and revised the technical content. 11/14/2013 21.0 None No changes to the meaning, language, or
formatting of the technical content. 2/13/2014 21.0 None No changes to the meaning, language, or formatting of the technical content. 5/15/2014 21.0 None No changes to the meaning, language, or formatting of the technical content. 6/30/2015 22.0 Major Significantly changed the technical content. 10/16/2015 23.0 Major Significantly changed the technical content. 7/14/2016 24.0 Major Significantly changed the technical content. 6/1/2017 24.0 None No changes to the meaning, language, or formatting of the technical content. 9/15/2017 25.0 Major Significantly changed the technical content. 12/1/2017 25.0 None No changes to the meaning,
Vendor-Extensible Fields EFSRPC does not include any vendor-extensible fields. This protocol uses Win32 error codes. These values are taken from the Windows error number space as specified in section 2.2. Vendors SHOULD reuse those values with their indicated meaning. Using any other value runs the risk of a collision in the future. Standards Assignments Parameter Value RPC Endpoint \pipe\lsarpc RPC Interface UUID {c681d488-d850-11d0-8c52-00c04fd90f7e} RPC Endpoint \pipe\efsrpc RPC Interface UUID {df1941c5-fe89-4e79-bf10-463657acf44d}
ProtectorsCount Protector_List_Entry 1 (variable) ... Protector_List_Entries (variable) ... Protector_List_Entry ProtectorsCount (variable) ... StructureSize (4 The size in bytes of the protector list. It MUST be a 32-bit unsigned integer in little-endian format. ProtectorsCount (2 bytes): This represents the number of protectors in the protector list. It MUST be a 16-bit unsigned integer in little-endian format. Protector_List_Entries (variable): A number of entries equal to the value in the ProtectorsCount field. The individual entries MUST be formatted as specified in section . EFSX Datum The EFSX Datum represents the base type for every datum within the Version 4 and Version 5 EFSRPC Metadata and MUST be formatted as follows. 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 StructureSize Role Type Flags StructureSize (2 The size in bytes of the EFSX Datum. It MUST be a 16-bit unsigned integer in little-endian format. Role (2 bytes): Specifies the EFSX Datum role. It MUST be a 16-bit unsigned integer in little-endian format. Value Meaning 0x0000 The EFSX Datum has no defined role. 0x0001 The EFSX Datum contains a reference to a user's certificate store. This reference could be, for example, a certificate hash or the public key from a certificate. 0x0002 The EFSX contains data specific to a protector type. See section for valid protector types and their associated protector data format. 0x0003 The EFSX contains information that is suitable for user display. For example, this could be the user name associated with a protector. 0x0004 The EFSX Datum contains information that identifies a private key container. 0x0005 The EFSX Datum contains information that identifies the provider name of a CSP or KSP.
FileName: An EFSRPC identifier, as specified in section . InfoClass: One of the values in the following With the exception of UPDATE_KEY_USED (0x00000100), a server SHOULD support all of these values. A server MAY choose to support UPDATE_KEY_USED.<41> Value Meaning BASIC_KEY_INFO 0x00000001 Request information about the keys used to encrypt the object's contents. On success, the server will return the information in an (2.2.14)structure in the KeyInfo parameter. CHECK_COMPATIBILITY_INFO 0x00000002 Requests the EfsVersion for the encrypted file. On success, the server will return the information in an structure in the KeyInfo parameter. UPDATE_KEY_USED 0x00000100 Update the user used to give a specific user access to an object. The server will populate the KeyInfo parameter with a zero-terminated, wide character string that contains a list of names of objects successfully updated. CHECK_DECRYPTION_STATUS 0x00000200 Request a hint from the server as to whether the given object could be successfully decrypted without further user intervention or higher-level events. The server will return separated
Index A 49 49 17 51 B 31 C 17 25 90 19 D 49 49 19 19 40 32 E 42 46 46 46 43 45 44 54 20 63 68 60 61 66 EfsRpcEncryptFileSrv method ( 60, 70) 64 69 70 69 64 57 62 EfsRpcQueryUsersOnFile method ( 62, 73, 83) 59 63 69 59 29 46 ENCRYPTION_CERTIFICATE structure ( 43, 47) 44 44 ENCRYPTION_CERTIFICATE_LIST structure ( 43, 48) Events 74 73 75 75 42 F 26 34 18 78 G 6 I 19 78 77 77 Index of security parameters ( 77, 78) 11 51 51 6 K 22 22 L 74 74 M 38 54 Messages 19 19 Methods 51 54 N 11 O 12