1

I have a dilemma with an important file folder and files within that have been encrypted by a domain user mistakenly. If I try to go to properties of an encrypted file > advanced details and uncheck “encrypt contents to secure data” logged into the user’s computer as themselves, I get a you will need to apply administrative permissions to change these attributes followed by an “access denied”. I also get this logged into as administrator of the domain.

The details show me logged in administrator of the domain as the recovery certificate holder and the user as a “user who can access this file”. However, I am unsure of what to do here next and don’t know much about EFS.

properties.jpg

Any help much appreciated.

8 Spice ups
2

So login to that server as the admin and you should be able to view and copy the file. In that case, EFS should do the decryption automagically.

3

Tried that already. Logged into the server as the domain\administrator shown as the recovery agent certificate above. Tried copying directly from the volume to the local desktop of the server and I get a “you need permissions to perform this action” even though the logged in administrator has full permissions and is the owner of the file.

I even tried to resort to our backup and it looks like the files have been encrypted further back than our backup history goes of 2 years and so they are encrypted/‘locked’ on our backup and immovable.

Any ideas of how do this via the recovery agent process?