Create recovery certificate for encrypted file in Vista system

You must be logged on as an administrator to perform these steps.

A recovery certificate is a special Encrypting File System (EFS) certificate that can be recovered if the encryption key is lost or corrupted if the certificate is created and installed correctly. You need to create a recovery certificate, install the certificate, and then update the previous encrypted file with the new recovery certificate.

Note: These steps cannot be completed on WindowsVista Starter, WindowsVista home Basic, and WindowsVista home Premium.

To create a recovery certificate:

It is recommended that you store the recovery certificate on removable media such as a CD or USB flash drive.

1. Open the command prompt as an administrator.

2. Insert removable media for storing certificates.

3. Navigate to the directory on the removable media drive where you want to store the recovery certificate, type cipher/r: filename, where the filename is the name you want to assign to the recovery certificate, and then press Enter. If you are prompted for an administrator password or confirmation, type your password or provide confirmation.

Note Windows stores certificates in a directory that is displayed at the command prompt. Removable media containing the recovery certificate should be kept in a secure location, such as a locked desk drawer.

Install the method that contains the recovery certificate:

1. Insert removable media that contains the recovery certificate.

2. Turn on "open Local Security" "If you are prompted to enter an administrator password or confirm, type your password or provide confirmation.

3. Click Public Key Policy, right-click Encrypting File System, and then click Add Data Recovery Agent. This action opens the Add Recovery Agent Wizard.

4. Click Next, and then navigate to your recovery certificate.

5. Click the certificate, and then click Open.

6. When asked if you want to install the certificate, click Yes, and then click Next.

7. Run the command prompt as an administrator.

8. At the command prompt, type gpupdate, and then press Enter.

To update previously encrypted file steps with a new recovery certificate:

1. Log in to the account you used when you first encrypted the file.

2. Run the command prompt at the administrator's status;

3. At the command prompt, type cipher/u, and then press Enter.

If you choose not to update the encrypted files with the new recovery certificate at this time, the files are automatically updated the next time you open them.