Problems setting up the Recovery Agent

I'm having problems setting up the Recovery Agent(RA) to work in my
domain. I would like to know if I'm missing any steps.
I have a 2003 domain and installed Windows CA on the DC machine.

I created a domain user which I will use primarily as a RA. I logged
into the CA machine as the RA and exported its certificate.
I relogged back into the machine as the domain admin and imported the
certificate so that it is a part of the Recovery Policy of the domain.
I imported the cert by going to the Group Policy Editor/Computer
Configuration/Windows Setting/Security Setting/Public Key
Policies/Encrypting File System. In the Add RA wizard, 2nd screen where
I select the user profile, after I finding the certificate file, it
displays User: USER_UNKNOWN. I don't know whether this indicates that
something is wrong already.

After completing this process, I see the Group Policy Editor under
Encrypting File System, my newly added RA is displayed.

Next, I try to test if this RA works by going on a workstation and
logging in as a normal domain user and encrypting a dummy text file. I
relog on as the RA, and import the cert of the RA into this machine and
then try to open up the dummy file. But failed. I then try to import
the private key file of the RA and then open the file and it still
fails. Both times it displays "Access is Denied" message.

I would like to know what I'm doing wrong.

Thanks a lot for any help

.

Relevant Pages

  • Re: Problems setting up the Recovery Agent
    ... Just wanting to clarify one thing about your test scenario. ... I created a domain user which I will use primarily as a RA. ... certificate so that it is a part of the Recovery Policy of the domain. ... I imported the cert by going to the Group Policy Editor/Computer ...
    (microsoft.public.windows.server.security)
  • EAP/TLS and "Windows was unable to find a certificate. . ."
    ... cert logged in as a domain user and promptly exported it ... certificate when I enabled 802.1x on the wireless ... >>launch IE, browse to the cert auth, request and install ...
    (microsoft.public.windowsxp.network_web)
  • Re: Serious EFS Issue
    ... If the workstation was joined to the domain and the user was ... a domain user, then I would think that the keys would still exist within the ... www.google.com might also have some recovery information for this scenario. ...
    (microsoft.public.windows.server.security)
  • Re: Who Told Me Norton Internet Security was crap?
    ... Reboot using the CD, Rescue and Recovery, do a system restore to remove ... all Microsoft Updates which gave me back administrative rights to my ... domain user. ...
    (uk.comp.homebuilt)
  • W2k CA within 2003 ADS
    ... Now only the the domain administrator are abel to enroll a certificate. ... Domain user can't enroll certificates, even they have administrator rights. ...
    (microsoft.public.security)