Recovery agent problem ????

[serge calderara]

Dear all,

I try to practice EFS and its recovery process with
Recovery agent key.

I have generate a RA key using cipeher /R option and
import them in my Local group policy.

When I encrypt a file with a user name USER1 in file
property encryption Detail button I can see Administraor
as rtecovery agent for the file. Fine

Then I logon as administrator and try to remove EFS on
that file , but I receive an Acess denied ?
In a similar way I cannot open the file

If in the generated file by user1 I add user2 as other
user who can use the file it works fine

how to soleve that issue?

thnaks for your answer

regards
serge

 

[Drew Cooper [MSFT]]

There are a couple of possibilities that spring to mind:
1. Administrator doesn't have ACL access to the file. If that's the case,
you can take ownership of the file, then decrypt.
2. The certificate (or private key) is not in the Administrator's user
profile. When you did "cipher /r" did you open the .pfx file that was
created and import the cert/key pair into the admin's Personal certificate
store? The .cer file has only the certificate. The .pfx has the
certificate and its corresponding private key (needed to decrypt a file).