Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Lets say I have a user in my organization who has forgotten his/her Windows logon password to their office computer. As an IT manager, I can log in via the Administrator and reset that user's password. So far, so good.

But if the user has used EFS to encrypt files on the disk, those files would be inaccessible after the password was changed, unless the cryptographic certificate had been backed up.

At the moment, a simple terminal command is employed to locate any encrypted files that may cause problems. All machines in the department run Windows XP Service Pack 3.

efsinfo /s:c: | find ": Encrypted"

The efsinfo command searches the hard drive C:, and pipes it's output to the find command, which filters out all non-encrypted files from the listing, displaying only the ones flagged with EFS encryptions.

My question: If this command (run with Administrator rights) displays nothing and completes without error, can I be certain there are actually no EFS-encrypted files on the disk? Are there any "gotchas" I should be aware of?

share|improve this question
up vote 1 down vote accepted

Yes, alternately, use cipher.exe:

cipher.exe /h /s:c:\

share|improve this answer
probably the port of gnu grep or microsoft's find or microsoft's findstr. looking for "E " – mbrownnyc Sep 7 '11 at 19:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.