Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Lets say I have a user in my organization who has forgotten his/her Windows logon password to their office computer. As an IT manager, I can log in via the Administrator and reset that user's password. So far, so good.

But if the user has used EFS to encrypt files on the disk, those files would be inaccessible after the password was changed, unless the cryptographic certificate had been backed up.

At the moment, a simple terminal command is employed to locate any encrypted files that may cause problems. All machines in the department run Windows XP Service Pack 3.

efsinfo /s:c: | find ": Encrypted"

The efsinfo command searches the hard drive C:, and pipes it's output to the find command, which filters out all non-encrypted files from the listing, displaying only the ones flagged with EFS encryptions.

My question: If this command (run with Administrator rights) displays nothing and completes without error, can I be certain there are actually no EFS-encrypted files on the disk? Are there any "gotchas" I should be aware of?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Yes, alternately, use cipher.exe:

cipher.exe /h /s:c:\

share|improve this answer
    
What's a good way to filter the results? –  Unsigned Sep 7 '11 at 18:58
    
probably the port of gnu grep or microsoft's find or microsoft's findstr. looking for "E " –  mbrownnyc Sep 7 '11 at 19:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.