cant get windows cipher.exe adduser to work

Question

I'm trying to find examples on how to properly use cipher.exe. Most of the info I've found doesn't cover adding users so they can also view the encrypted file. I'm trying to create a script which will programatically encrypt certain files and add certain users so they can also view them. I'm not too familiar with Windows administration, Active Directory, etc. This is what I've been trying to do:

c:\users\xxxxx\documents\test> cipher /adduser /user:testuser abc.txt

testuser is another user in the domain. "abc.txt" is a file in the current directory. There are other options for adduser -- /certhash and /certfile, but I have no idea how I would go about getting these. Is this something handled by Active Directory?

Answer 1

I've found that adding a user that hasn't had its certificate cached on the server yet, will fail.

I solve this by running a CMD window as that user (Run as a different user), then using cipher.exe in that context to encrypt a single file.

That operation caches the users certificate on the server, so I close that CMD and return to my "normal" commandline. Subsequent /ADDUSER operations are OK after that.

Hope that helps,

Thomas