How can I add a user as an EFS recovery agent for a domain?

A. Recovery agents are users who can recovery encrypted files for adomain. To add new users as recovery agents they must first have recoverycertificates issued by the enterprise CA structure (a local certificategranted by the Administrator is no use).

Refresh the machine policy

C:> secedit /refreshpolicy machine_policy

The agent will only be able to recover files encrypted after the user wasmade an agent. If an encrypted files is unencrypted and the encrypted or evenjust opened thenew agent WILL be able to recover it as the file will "refresh" itsrecovery certificates (if the recovery policy has changed).

The local admin on a standalone PC or the first logon admin on a DC is the recovery agent by default. However this can be modified. You canremove the default recovery agent and assign any one as the recovery agent. In other words, admin can not read other person's encrypted file unless he isthe recovery agent. The purpose of assigning the first logon admin as the recovery agent is to make life easier for most of our customer. The corporateuser is recommended to modify the recovery agent.