In my last article, I described how to use Windows 2000's Encrypting File System (EFS) to prevent an attacker from stealing confidential files from your laptop. I also iterated the importance of selecting hard-to-guess passwords and taking steps to protect your system against the Ntpasswd utility. As a final thought, I recommended that you always export and delete the recovery agent certificate. This last recommendation is especially important when you maintain Win2K-based systems that aren't members of an Active Directory (AD) domain, which is often the case with a mobile work force.
Data Recovery Without Active Directory
EFS won't work unless you define at least one recovery agent for each Win2K system. Win2K systems that are members of an AD domain use the domain’s recovery policy, and the domain Administrator account is the default recovery agent. Win2K systems that aren't members of an AD domain automatically define the local Administrator account as the recovery agent. . . .
Register
