This may be of use
[i]How to encrypt and decrypt using the Encrypting File System
The following steps encrypt and decrypt a file or folder using the Encrypting File System.
Note These guidelines apply to Windows 2000 and Windows XP.
Encrypting a folder
Although you can encrypt files individually, we strongly recommend that you designate a specific folder for storing encrypted data.
Encrypt a folder and its contents
Although you can encrypt files individually, generally it is a good idea to designate a specific folder where you will store your encrypted files, and to encrypt that folder. If you do this, all files that are created in or moved to this folder will automatically obtain the encrypted attribute.
To encrypt a folder and its current contents, follow these steps: 1. Right-click the folder that you want to encrypt, and then click Properties.
2. In the Properties dialog box, click Advanced.
3. The Advanced Attributes dialog box displays attribute options for compression and encryption. This dialog box also includes archive and indexing attributes.
Note Although the NTFS file system supports both compression and encryption, it does not support both at the same time. This means that you can only select one or the other. A file or folder cannot be both encrypted and compressed at the same time.
To encrypt the folder, click to select the Encrypt contents to secure data check box, and then click OK.
4. Click OK to close the Advanced Attributes dialog box.
5. If the folder you chose to encrypt in steps 1 to 3 already contains files, a Confirm Attribute Changes dialog box will appear.
You can choose to encrypt only the folder so that all files subsequently moved to the folder or created in this folder will be encrypted. If you want to also encrypt all the contents of this folder, click Apply changes to this folder, subfolders, and files, and then click OK.
Decrypting a folder
To decrypt a folder, use basically the same process but in reverse order: 1. Right-click the folder that you want to decrypt, and then click Properties.
2. Click Advanced.
3. Click to clear the Encrypt contents to secure data check box to decrypt the data.
4. Click OK to close the Advanced Attributes dialog box.
5. Click OK to close the Properties dialog box.
6. If the folder has files in it, the Confirm Attribute Changes dialog box appears. You can choose to decrypt only the folder. However, this will not decrypt any files currently contained in the folder.
If you want to decrypt all the contents of this folder, click Apply changes to this folder, subfolders, and files, and then click OK.
Back to the top
Additional information
How files are encrypted
Files are encrypted through the use of algorithms that essentially rearrange, scramble, and encode the data. A key pair is randomly generated when you encrypt your first file. This key pair is made up of a private and a public key. The key pair is used to encode and decode the encrypted files.
If the key pair is lost or damaged and you have not designated a recovery agent, and then there is no way to recover the data.
Why you must back up your certificates
Because there is no way to recover data that has been encrypted with a corrupted or missing certificate, it is critical that you back up the certificates and store them in a secure location. You can also specify a recovery agent. This agent can restore the data. The recovery agent's certificate serves a different purpose than the user's certificate.
How to back up your certificate
To back up your certificates, follow these steps: 1. Start Microsoft Internet Explorer.
2. On the Tools menu, click Internet Options.
3. On the Content tab, in the Certificates section, click Certificates.
4. Click the Personal tab.
Note There may be several certificates present, depending on whether you have installed certificates for other purpose.
5. Select one certificate at a time until the Certificate Intended Purposes field shows Encrypting File System. This is the certificate that was generated when you encrypted your first folder.
6. Click Export to start the Certificate Export Wizard, and then click Next.
7. Click Yes, export the private key to export the private key, and then click Next.
8. Click Enable Strong protection, and then click Next.
9. Type your password. (You must have a password to protect the private key.)
10. Specify the path where you want to save the key. You can save the key to a floppy disk, another location on the hard disk, or a CD. If the hard disk fails or is reformatted, the key and the backup will be lost. (If you back up the key to a floppy disk or CD, you must store that disk or CD in a secure location.)
11. Specify the destination, and then click Next.
For additional information about the Encrypting File System (EFS), visit the following Microsoft Web site:
Encrypting File System in Windows 2000
http://www.microsoft.com/technet/security/prodtech/windows2000/w2kccadm/dataprot/w2kadm21.mspx (http://www.microsoft.com/technet/security/prodtech/windows2000/w2kccadm/dataprot/w2kadm21.mspx)
Encrypting File System in Windows XP and Microsoft Windows Server 2003
http://www.microsoft.com/technet/security/guidance/cryptographyetc/efs.mspx (http://www.microsoft.com/technet/security/guidance/cryptographyetc/efs.mspx)[/i]
Or this may be of some use though you will have to create another user profile which isn't hard to do.
[i]EFS Recovery Agent Cannot Export Private Keys
View products that this article applies to.
Article ID : 259732
Last Review : October 31, 2007
Revision : 3.4
This article was previously published under Q259732
SYMPTOMS
When you attempt to perform encrypted data recovery, the "Export Private Key" section of the Certificate Export Wizard is either skipped completely, or the Yes, export the private key option within the "Export Private Key" screen is inactive and cannot be selected. The No, do not export the private key option is the only valid selection. If the option to export the private key is inactive, the following error message is displayed:
Note: The associated private key cannot be found. Only the certificate can be exported.
Typically, the option to export the private key at the "Export Private Key" section of the Certificate Export Wizard is available.
Back to the top
CAUSE
This behavior can occur if the Administrator profile was overwritten with another user's profile. Users that belong to the local Administrator group can copy a user profile over another user's profile. This is typically done to replicate profiles with minimal effort. If this is done to the local Administrator profile, the computer no longer recognizes the administrator as a valid EFS Recovery Agent.
You may also experience this behavior if you made the request of the certificate server not to issue exportable certificates. The only way around this is to request a new certificate if you already have one issued.
IMPORTANT: Do not delete the existing certificate until all of the data has been un-encrypted and then re-encrypted.
NOTE: The default EFS Recovery Agent of a stand-alone Windows 2000 Professional-based computer that is not a member of a domain is local Administrator.
Back to the top
RESOLUTION
To restore the Recovery Agent's private key, use one of the following methods: ? Restore the administrator's user profile from a backup that was made before the administrator's profile was overwritten.
? Restore the data from a backup that you made before the data was encrypted using EFS.
You must extract the private keys from an EFS Recovery Agent whose profile is not overwritten. If this is a stand-alone computer, no other Recovery Agents may be available. If there is no other Recovery Agent available and the EFS private key is not backed up, the data is not recoverable.
Back to the top
MORE INFORMATION
For additional information about EFS in Windows 2000, click the article numbers below to view the articles in the Microsoft Knowledge Base:
241201 (http://support.microsoft.com/kb/241201/EN-US/) HOW TO: Back Up Your Encrypting File System Private Key in Windows 2000
255742 (http://support.microsoft.com/kb/255742/EN-US/) Methods for Recovering Encrypted Data Files
223316 (http://support.microsoft.com/kb/223316/EN-US/) Best Practices for Encrypting File System
242296 (http://support.microsoft.com/kb/242296/EN-US/) How to Restore an EFS Private Key for Encrypted Data Recovery
Additional EFS-related information is available at the following Microsoft Web site:
http://www.microsoft.com/technet/security/prodtech/windows2000/w2kccadm/dataprot/w2kadm21.mspx[/i]
Col
