The user and the local administrator (if he is a Data Recovery Agent)
At Basic ideas
However, the cryptography keys for EFS are in practice protected by the user account password.
This password is also stored in the SAM, which is encrypted with a system key...
Which means that not only the user can access it! Here are the details:
At Decrypting files using the local Administrator account
In Windows 2000, the local administrator is the default Data Recovery Agent, capable of decrypting all files encrypted with EFS by any local user. EFS in Windows 2000 cannot function without a recovery agent, so there is always someone who can decrypt encrypted files of the users. Any non-domain-joined Windows 2000 computer will be susceptible to unauthorized EFS decryption by anyone who can take over the local Administrator account, which is trivial given many tools available freely on the Internet.
In Windows XP and later, there is no default local Data Recovery Agent and no requirement to have one. Setting SYSKEY to mode 2 or 3 (syskey typed in during bootup or stored on a floppy disk) will mitigate the risk of unauthorized decryption through the local Administrator account. This is because the local user's password hashes, stored in the SAM file, are encrypted with the Syskey, and the Syskey value is not available to an offline attacker who does not possess the Syskey passphrase/floppy.
This hasn't changed towards Windows 7, if you want to know feature changes see this Wikipedia portion.