Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I cannot ask our Domain Admins to update recovery agent, since they are in other country and they serve millions of people worldwide (actually, I've asked with no success).

  1. GPO disables EFS at all, but I've overridden that by HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\EFS\EfsConfiguration = 0

  2. Still can not encrypt because of other error - Recovery Agent are expired (not surprisingly)

I know that this is incorrect behavior as a network member, I now that this is a hack an tricky workaround... but I'm ready to that kind of solution. Could anybody suggest how to override EFS recovery agent settings?

share|improve this question

You cannot override domain group policy. It will be reapplied in a few minutes. Never use EFS for personal data such as keeping your browser profile and passwords safe. A domain admin can simply secretly add a recovery agent and access all your encrypted files.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.