Getting very close to decommissioning our old CA. The new CA is in place and happily issuing certificates and the old CA has had all the templates removed so no certificates will be issued.
My concern about the decommissiong process though is revoking "Basic EFS" certificates. It appears as if there have been several of these certificates issued in our domain and although the users in question are adamant they have no encrypted documents I take that with a pinch of salt. During the decomm the process is to set the CRL to a sutiable time frame and then revoke all certificates. As the "Basic EFS" does not support Autoenroll I am worried that there will end up being encrypted documents that we now cannot access.
Is there a method to ensure seamless transfer of EFS certificates from one CA to another? Or am I over complicating it and a new certificate will be issued when required by the new CA?