Fixing the "Encrypt the Offline Files Cache" Setting in Group Policy

Make sure you have the KB810859 hotfix installed on the client. Without this hotfix, the Offline Files cache will never be encrypted unless a user with Administrator privileges logs on. SP3 for XP includes this fix. If SP3 hasn't been installed, you can download the hotfix from the Microsoft article "The 'Encrypt the Offline Files cache' Group Policy setting does not take effect when a user logs on to a Windows XP-based computer".

Make sure that the system.adm file is up-to-date on the system that you use to manage Group Policy. Go to %windir%inf and open the system.adm file in Notepad. Search for the line

CLIENTEXT \{C631DF4C-088F-4156-B058-4375F0853CD8\}

If you find it, you should be fine. If you don't find it, install the KB810859 hotfix on that machine or add the line manually, following the instructions in "The 'Encrypt the Offline Files cache' Group Policy setting does not take effect when a user logs on to a Windows XP-based computer".

On the system you use to manage Group Policy, open the Group Policy Object (GPO) in which you set the Encrypt the Offline Files Cache option. Remove the GPO by setting it to Not Configured and clicking Apply. Then re-enable the GPO by setting it to Enabled and clicking Apply. This will update the gPCMachineExtensionNames attribute in the GPO, which will trigger the new functionality introduced by the hotfix. If you don't perform this step, the problem won't be resolved.

Perform step 3 on any other GPOs that include the Encrypt the Offline Files Cache setting.

Make sure that the client has some offline files. This might sound obvious, but the Encrypt the Offline Files Cache setting won't be applied until there are some offline files to encrypt.

At this point, even though the Encrypt the Offline Files Cache setting is enabled, it won't be applied to a newly created or unencrypted Offline Files cache until the next Group Policy refresh interval, which is 90 minutes by default in most systems. This is a design flaw. It means that when the offline files are first synchronized, they're not encrypted, leaving a period when the system is potentially insecure. It also means that there's a danger that copies of the unencrypted offline files are still on the hard disk. For these reasons, I recommend that you open a command shell window on the system where the Offline Files have been synchronized and run the command

gpupdate

After a few seconds, the encryption process will begin and the files in %SystemRoot%CSC should start to go green. In addition, the Encrypt offline files to secure data check box on the client will be selected.