EFS - Recovery agent

[barabba]

Hello all,

Microsoft says, in its Windows 2000 Resource Kit, what follows:

QUOTE
=====
By default, the recovery agent account is the highest-level
Administrator account. On a stand-alone computer, this is the local
Administrator.
END QUOTE
=========

I encrypted a file in a Windows Pro standalone using a regular user.
Then I logon as local administrator but was denied access to the file.
So why the local admin cannot decrypt the file ? Shouldn't it be by
default granted such right ?

Thank you for your time. I'm a bit confused about this.

Bar

 

[Roger Abell]

That info you quote is so for Windows 2000.
In Windows XP there is no default recovery agent for
a stand alone system.
You have not mentioned your version of Windows Pro.

Also, the account must have NTFS permissions on the
file to be able to decrypt it.

 

[barabba]

Thank you very much for your answer. I should have read better along the lines ;-)

 

[Roger Abell]

If you do have XP Pro, then defining a DRA is advised, as is
other loss preventatives such as making a password reset disk
and exporting and preserving the EFS cert/key (both actions for
any account that uses EFS). See
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/cryptfs.mspx