I have a machine here that is joined to a domain. Some days ago, I did a disk image of that workstation because the HDD was begin to fail. I put the new drive in the machine and the user now complains that he cannot read some of his files. It appears he has a folder tree encrypted by EFS. I put the old disk back in his machine and still cannot read those encrypted files... Is there a way to recover them?
If you setup recover agents in group policy, you should be able to install the recovery agent's private key onto the new machine and decrypt the files when logged in as that user. Also another option would be to see if you can export the users private key from the CA or if it has already been exported somewhere else and install this key for the user. If neither of these are a viable option I believe you are pretty much SOL.
EDIT: to answer question in comments.
First, you will need your recovery agent's private (.pfx) key+cert not just the certificate (.cer)
To import your private key (.pfx) you need to do the following:
Once you have installed the private key, you will be able to decrypt the files.
|show 1 more comment|