I've heard of many people using Encrypting File System (EFS) to protect their confidential files but later losing that information when they upgrade their computer or lose the computer and try to restore from backups. How can I avoid losing data when using EFS?
I constantly receive queries from distressed users and administrators who are desperate to get some important files back after experiencing the events you mention above. The best way to prevent data loss is by backing up the data recovery agent certificate and/or the user's EFS certificate and private key. Without one of these certificates and its private key, there is usually no way to recover an encrypted file.
If your computers are part of an Active Directory (AD) domain, you can take advantage of a Group Policy feature that allows you to set up a single data recovery agent certificate that can be used to decrypt any encrypted files in the domain. If a central data recovery agent isn't an option, then you must export each user's EFS certificate along with its private key and store it in a safe place.
To export a certificate, log on as the user in question and open the Microsoft Management Console (MMC) Certificates snap-in (not the MMC Certificate Templates snap-in or MMC Certification Authority snap-in). Open the user's Personal\Certificates folder and find the EFS certificate. Right-click it and select All Tasks, Export. Click Next on the first page of the wizard, select Yes, export the private key, and click Next until prompted for a filename. Save the file to some type of removable media and finish the wizard. Now store the certificate in a physically safe place.
In the future, if a user is unable to access a file—whether it's been restored to a new computer or Windows has been reinstalled, just use the Certificates snap-in to import the certificate, and your problem is solved. A final note: Your concern about losing data is well placed. There is no back door into EFS; if you lose the key(s) to it, you lose your data.
