Ecrypted files inaccessible after password reset

[Oliver]

Hi,

I recently forgot the password to my user account on my local machine, so I
looged in as administrator and did a password reset for my user account. When
I went back into the user account, I could no longer access any of the
encrypted files. Why is this and how can I make them accessible again?

 

[Lem]

Hi,

I recently forgot the password to my user account on my local machine, so I
looged in as administrator and did a password reset for my user account. When
I went back into the user account, I could no longer access any of the
encrypted files. Why is this and how can I make them accessible again?

Remember the original password and change back. See the last section of
http://support.microsoft.com/kb/331333/

Another victim realizes too late the dangers of the Windows Encrypting
File System. For those lurkers who feel an irresistible urge to use
Windows EFS, make sure to follow the "Best Practices" -
http://support.microsoft.com/kb/223316/en-us

There is also KB316994. This Hotfix probably does NOT apply to you
because you [probably] don't satisfy criterion 4 ("You have logged on to
your computer by using cached credentials when your computer is not on
the network"). I'm virtually certain that the Hotfix will not work
without cached credentials -- if it did, that would be a much too easy
back door past the EFS.

 

[John Wunderlich]

Remember the original password and change back.

Alternatively, do a System Restore to a date before you changed the
password then keep trying passwords.

-- John

 

[Anteaus]

You basically have two options: remember the password, or try accessing the
files as Administrator. (which account is usually set as the recovery agent

 

[Paul]

Alternatively, do a System Restore to a date before you changed the
password then keep trying passwords.

-- John

Once the System Restore is done, and the original password is
back in place, there might be some tool around that can figure
out the password. For example, here a LiveCD is mentioned, that
can automatically crack the passwords. I have no idea how safe this
is, whether source code is available etc etc. But if you're desperate,
and willing to do whatever it takes to get the data back, something
like this might work.

http://www.raymond.cc/blog/archives/2006/11/22/how-to-crack-windows-account-password/

http://en.wikipedia.org/wiki/Ophcrack

Paul

 

[sanjacstudent12]

You basically have two options: remember the password, or try accessing the
files as Administrator. (which account is usually set as the recovery agent

No, logging in as an administrator will not work. The only way to access
those files without the encryption key is with the password.

There are tools out there that may be able to crack the password, but there
is no guarantee that they will work for you.

 

[Twayne]

In

No, logging in as an administrator will not work. The only
way to access those files without the encryption key is
with the password.

There are tools out there that may be able to crack the
password, but there is no guarantee that they will work for
you.

To date, and this is something I watch for all the time, there
has never been anything that could crack the passwords if the
password was anything barely useful as a password. e.g., not
their last name, etc..

 

[dennis]

To date, and this is something I watch for all the time, there
has never been anything that could crack the passwords if the
password was anything barely useful as a password. e.g., not
their last name, etc..

Depending on the configuration of Windows, "skRV96vhP!z" is cracked very
fast

 

[Twayne]

In

Depending on the configuration of Windows, "skRV96vhP!z" is
cracked very fast

Well that says a lot of nothing.