Any way to block EFS Data Recovery Agent?

Question

It seems that using EFS is pointless if someone else has access to your computer because of DRA... someone could easily enable the Administrator account set a DRA save the keys disable the Administrator account again or just make themselves a DRA if they are an Administrator so the next time you log in and start using your files the DRA certificate is added to the files.

EFS would protect you if your computer was stolen but it seems that EFS is used mainly for multi-user computers.

Because EFS is used to protect files from other users the Syskey utility doesn't do anything because they need to get past it as well.

So... is there a way to completely remove/block the ability to add a Data Recovery Agent to Windows 7 or maybe another solution to this issue?

Answer 1

someone could easily enable the Administrator account set a DRA save the keys disable the Administrator account again

But to do that, they must have administrator rights themselves, so enabling the Administrator account would be pointless as they could make themselves a DRA.

In the end, if someone has physical access to the computer, they can get around any protection using even something as simple as a hardware keylogger to snatch your own password.

Answer 2

It seems the only way to have a multi-user computer and prevent the DRA from being enabled and used to gain access to another users files is to have all users as regular users and only one trusted person with the administrator account/password and then fully encrypt the OS drive and only allow that trusted administrator to start the computer and use hibernate when not in use.

I find it pretty ridiculous that to securely use EFS in a multi-user environment where it is very useful you need to use another encryption solution.

Yes the system could be compromised physically but when the main threat is a teenage script kiddie this is not that much of an issue as they are most likely not going to be able to afford a $50-80 keylogger and one of those is rather noticeable on a laptop.