Jonas L

Completely. But @msftsecurity focus on others subject and doesn't make statements about [MS-EFSR]

Yes, and a good catch too in their documentation. It will be hard to justify NOFIX in face of this.

I'm trying to understand the use case for the EfsRpcOpenFileRaw call. Who is supposed to make this call and on what kind of UNC path?

Backups :)

yep it's a backup feature ignores file locks, too

Thanks! So if we break this in any way, we break backup? Is this then completely broken by design then and literally couldn't be patched by MS?

You can retrieve files via that RPC call, unauthenticated. There's also a function to encrypt files... and remove decryption metadata.

So which user account is making this call in a legitimate scenario? Backup operator?