the Master Key using an SHA1 hash of the password. This also improves the security of data encrypted with Encrypting File System. PKI support Windows XP PKI supports cross-certification and Bridge CA scenarios. User-type certificates can be auto-enrolled and renewed. Certificate requests for issuing new certificates or renewing expired ones can be pending until administrator approval or until issued by the certificate authority and once approved, they install automatically. Root CA certificates now also auto-update via Microsoft Update. Windows XP also supports delta CRLs (CRLs whose status has changed since the last full base compiled CRL) and base64-encoded CRLs for revocation checking and will use them by default. Windows XP can enroll version 2 certificate templates which have many configurable attributes. Smart cards can be used to log into terminal server sessions (when connecting to a Windows Server 2003 or higher Terminal Server), with CAPICOM or with system tools such as net.exe and runas.exe. There are also numerous improvements to certificate status checking, chain building and revocation checking, path validation and discovery. Encrypting File System Windows XP includes several Encrypting File System improvements The most notable improvement is that multiple user accounts can share access to encrypted files on a file-by-file basis. A Details button in the Advanced file attributes dialog in the file's properties allows adding or removing additional users who can access the EFS-encrypted file, and viewing the certificate thumbprint and the Data Recovery Agent account. EFS certificates are autoenrolled in the CA and there is support for revocation checking on certificates used when sharing encrypted files. Unlike Windows 2000, there is no default local Data Recovery Agent and no requirement to have one, although a self-signed certificate for the recovery agent can be generated using cipher.exe. The DPAPI Master Key can be protected using a domain-wide public key. A stronger FIPS 140-1 compliant algorithm such as 3DES can be used. Windows XP also warns the user if the EFS encrypted files are being copied to a file system such as FAT or unsupported location which does not support EFS, and thus the file is going to get decrypted. Windows XP can also encrypt files on a remote server with NTFS if the server is trusted for delegation in Active Directory and the user's certificate and private key are loaded in the local profile on the server. If a roaming user profile is used, it will be copied