Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know EFS data recovery has been discussed so many times in the forums but I could not find anything useful in the other threads as I believe I have followed all the required steps but still cannot get EFS recovery agent to work.

I have a Client1 (Win 8.1) and a DC1 (Windows Server 2012 R2) under domain.

DC1 is a CA server as well as a domain controller. 1.I logged into DC1 as\Administrator which is the Domain Administrator account.

2.I duplicated the EFS Recovery Agent template on the DC1 and published it into Active Directory.

3.Then I edited the Default Domain Policy GPO and under Computer Settings\Policies\Windows Settings\Security Settings\Public Key Policies I right clicked Encrypting File System and selected Create a Data Recovery Agent and a new file recovery certificate was generated for the Administrator account.

4.I exported the newly-created Recovery Agent certificate and then logged into Client1 as\Administrator and imported it.

5.I then logged off from Client1 and logged back in using a different account\johns and encrypted a folder (with a text file inside) using EFS. (The folder address on local disk is C:\Reports)

6.Then I logged back into Client1 again using\Administrator but I am unable to open the file inside the folder and I get an Access is denied message.

It is very strange to get an "Access is denied" message because on the text file when I right click and click Properties -> Advanced -> Details, under the Recovery Certificates, the Administrator account's certificate is listed and its thumbprint corresponds to the same recovery certificate which I created in step 3. But I am still unable to access the file.

Do you have any idea why? Am I missing something?

Thanks in advance.

share|improve this question

We have had issues with encrypting files on a fileshare where we would lose access to the files after a reboot. Rebooting clears the local certificate cache on the server.

Apparently we solved this by trusting the server computer for delegation. This is done in Active Directory, under the server computer's object - there is a pane called "Delegation". By default all computers are not trusted for delegation, but by setting "Trust this computer for delegation to any service (Kerberos only)" we were able to access encrypted files across our filshare even after a reboot.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.