locally. On a WebDAV server mapped by a drive letter, Windows XP can encrypt the file locally and transport it as a raw encrypted file to the WebDAV server using the HTTP PUT command. Similarly, EFS encrypted files can be downloaded raw from the WebDAV and decrypted locally. The command line utilities cipher, copy and xcopy have been updated in Windows XP. EFS can also be completely disabled in Windows XP through Group Policy (for a domain) or through the registry (for a non-domain computer). For faster cache validation, the time for how long the user session key and certificate chain are cached can be adjusted. Password Reset Wizard Starting with Windows XP, a password reset disk can be created using the Forgotten Password wizard. This disk can be used to reset the password using the Password Reset Wizard from the logon screen. The user's RSA private key is backed up using an offline public key whose matching private key is stored in one of two places: the password reset disk (if the computer is not a member of a domain) or in Active Directory (if it is a member of a domain). An attacker who can authenticate to Windows XP as LocalSystem still does not have access to a decryption key stored on the PC's hard drive. If the password is reset, the DPAPI master key is deleted and Windows XP blocks all access to the EFS encrypted files to prevent offline and rogue attacks and protect the encrypted files. If the user changes the password back to the original password, EFS encrypted files can be recovered. Credential Manager Windows XP prompts for credentials upon authentication errors and allows saving those that use Integrated Windows Authentication to a secure roaming keyring store protected by the Data Protection API. Saved credentials can be managed from the Stored User Names and Passwords item in the User accounts control panel. If a certificate authority is present, then users can a select an X.509 certificate when prompted for credentials. When that same resource is accessed again, the saved credentials will be used. Remote access/VPN connections also create temporary credentials in the keyring to make the experience seamless. Credential Manager also exposes an API for Single Sign On. Software Restriction Policies Windows XP introduces Software Restriction Policies and the Safer API By use of Software Restriction Policies, a system may be configured to execute