1

Lets say I have a user in my organization who has forgotten his/her Windows logon password to their office computer. As an IT manager, I can log in via the Administrator and reset that user's password. So far, so good.

But if the user has used EFS to encrypt files on the disk, those files would be inaccessible after the password was changed, unless the cryptographic certificate had been backed up.

At the moment, a simple terminal command is employed to locate any encrypted files that may cause problems. All machines in the department run Windows XP Service Pack 3.

efsinfo /s:c: | find ": Encrypted"

The efsinfo command searches the hard drive C:, and pipes it's output to the find command, which filters out all non-encrypted files from the listing, displaying only the ones flagged with EFS encryptions.

My question: If this command (run with Administrator rights) displays nothing and completes without error, can I be certain there are actually no EFS-encrypted files on the disk? Are there any "gotchas" I should be aware of?

Improve this question

1 Answer 1

Reset to default
1

Yes, alternately, use cipher.exe:

cipher.exe /h /s:c:\

Improve this answer
1

You must log in to answer this question.