Troubleshoot Encrypting File System (need clarification)

---

Dear IT Pro

I need to understand this EFS Scenario? if your using a DRA (Data recovery Agent) and then ask the user to encrypt the file again, then what's the point of using the DRA Agent? ( see the following example text below)

I can’t open files I have encrypted Only users with the correct EFS certificate and private key for the file can open EFS-protected files. Has the user account been deleted/recreated since the file was created? Use a DRA to recover the file and have the user encrypt the file again.

resource used Safari online (Oreilly online books) Exam Reference 70-697 second edition Microsoft Press book I think?

https://learning.oreilly.com/library/view/exam-ref-70-697/9781509307944/ch05.xhtml

https://learning.oreilly.com/library/view/exam-ref-70-697/9781509307944/ch05.xhtml#

Hey @Daniel-Loyer ,

Good question. The links don't seem to be working, but I think I get the idea behind the question. See if this makes sense.

The user has encrypted files in the past. That means they have a certificate and the matching private key, which is stored in there user profile. When the profile was deleted, they lost their private key. Recreating the account won't recreate the private key. So at this point, they cannot access their encrypted files. They need to reestablish access to these files.

A data recovery agent can decrypt all files (that have been encrypted since creation of the DRA). So the DRA is used to decrypt the files. The files are no longer encrypted, so the user can access them again.

This is where it can be a little confusing. We have to remember, the DRA didn't just open the files, they removed the encryption. They are now plaintext files.

So the files need to be encrypted again. If the DRA encrypts the files, the DRA's private key will be used. So only the DRA will be able to access the files. So we need to issue the user a new certificate and key, and have them encrypt the file again.

Hope this helps,