Re: where to get a recover agent certificate

From: Roger Abell [MVP] (mvpNoSpam_at_asu.edu)
Date: 05/30/03 

Date: Fri, 30 May 2003 11:51:10 -0700

Make sure you have that exported cert/key safe, probably more
thatn on copy (especially if you are using a floppy).

cipher /?
will give syntax for the cipher command that is used to
create the needed DRA cert/key pair for defining a
recovery agent.

see
Data Protection and Recovery in Windows XP
http://microsoft.com/WINDOWSXP/pro/techinfo/administration/recovery

Best Practices for Encrypting File System
http://support.microsoft.com/?id=223316

Export a certificate with the private key
http://microsoft.com/windowsxp/home/using/productdoc/en/sag_CMprocsExportPriv.asp

Importing and exporting certificates
http://microsoft.com/windowsxp/home/using/productdoc/en/sag_CMimportExport.asp

"Luke" <me@yourhouse.com> wrote in message
news:q4NBa.6$TL2.2249800@newssvr10.news.prodigy.com...
> When I was upgrading from XP Home to XP Pro, I changed my password on my
> account, went away for some time, and forgot my password, so I had to log
in
> as Administrator, and reset my password. In doing so, I lost access to my
> encrypted files.
> Since then, I deleted the file, and started up a new one, but to prevent
> this from happening again, I want to have a Recovery Agent.
> Well, when I run the Add Recovery Agent Wizard, it asks for a certificate,
> which I have not been able to find on my computer or export one from any
of
> my certificates I currently have, (Or maybe I am just exporting the wrong
> one)
> Currently, I have NO recovery agents listed on any of my encrypted files,
> and I want to add one.
> Until I can though, I backed up my efs certificate, which is something I
> should have done before the upgrade to begin with, but I still want to add
a
> recovery agent in case my girlfriend loses her encrypted files this way
(ie,
> forgetting her password, and having me reset it, causing her to lose
access
> to her encrypted files)
> I'm going to have her back up her efs certificate, just in case, but I
would
> still like to have a recovery agent.
> Thanks for any information
> Luke
>
>

Relevant Pages

  • Re: EFS
    ... became the recovery agent. ... it from a mmc console using the certificate snapin for the user while logged ... > If I understand EFS correctly, one should export the private key along ... > What are the ramifications of not exporting the private key? ...
    (microsoft.public.win2000.security)
  • Re: EFS
    ... > became the recovery agent. ... > from certificate store and remove it from local security policy/public key ... >> If I understand EFS correctly, one should export the private key along ... >> What are the ramifications of not exporting the private key? ...
    (microsoft.public.win2000.security)
  • Re: XP experts help needed
    ... Unless you designated a recovery agent and exported the encryption key ... and certificate, the encrypted files will not be accessible and there is ...
    (microsoft.public.windowsxp.general)
  • Re: How to add a domain user as a Data Recovery Agent
    ... Policy settings or contacting a domain controller. ... Recovery Agent certificate and when you examined the certificate are the ...
    (microsoft.public.windows.server.security)
  • Re: How to add a domain user as a Data Recovery Agent
    ... Recovery Agent certificate and when you examined the certificate are the ... I'm trying to figure out how to add a non-privileged, domain user account ... I add the users as data recovery agents. ...
    (microsoft.public.windows.server.security)