Microsoft KB Archive/257705

= How to reinitialize the EDRP on a workgroup computer running Windows 2000 =

Article ID: 257705

Article Last Modified on 10/31/2006

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Professional Edition

-



This article was previously published under Q257705





IN THIS TASK
SUMMARY
 * Reinitializing the Recovery Policy



SUMMARY
This article describes how to reinitialize the local recovery policy on a Windows 2000-based computer. This process does not reinitialize a domain recovery policy. For Windows 2000-based domain members, the local recovery policy is superseded by the domain recovery policy.

Encrypting File System (EFS) provides built-in data recovery by enforcing a recovery policy requirement. The requirement is that a recovery policy must be in place before you can encrypt files. The recovery policy provides for a person to be designated as the recovery agent. When an administrator logs on to the computer for the first time, a default recovery policy is automatically created, which makes that account the recovery agent.

The local recovery policy contains the EFS Recovery certificate for the Recovery agent. As long as the policy is populated with this certificate, users can encrypt files. It is possible, however, to lose the private key associated with the Recovery certificate (if the user profile is deleted, for example). If this occurs, the Recovery agent is unable to recover any encrypted files.

Computers that are in a workgroup are most susceptible to this. Computers that are members of a domain inherit their recovery policy from that domain.

back to the top

Reinitializing the Recovery Policy
 Log on to Windows 2000 by using the Recovery Agent account. Open the Local Security Policy snap-in in Microsoft Management Console (MMC) that is located in the Administrative Tools folder. Open the Public Key Policies folder, and then click the Encrypted Data Recovery Policy (EDRP) folder. Delete the recovery certificate in the policy, and then quit the snap-in. Start MMC, and then add the Certificates snap-in to the current user account. Open the Personal store, and then delete the recovery certificate. This certificate has the same user name in the Issued To and Issued By columns, and contains the value "File Recovery" in the Intended Purposes column.</li> Quit MMC.</li> At a command prompt, type the following lines, pressing ENTER after you type each line:

regsvr32 -u sclgntfy.dll

regsvr32 sclgntfy.dll

</li> Log off and log on again using the Recovery Agent account. A new certificate and private key is created for that account. New encrypted files are recoverable by this user. Existing files become recoverable when they are opened and then closed by the owner of the file.</li></ol>

back to the top

Keywords: kbefs kbhowto kbhowtomaster kbnetwork KB257705

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.