Microsoft® Windows® 2000 Security Handbook

Using EFS

EFS must have a recovery agent available before a file can be encrypted. In a default installation, the recovery agent is always available, but it can be disabled; in that case you get an error message indicating the operation cannot happen. Later in this section, you will see how to disable EFS, enable EFS, and back up recovery agent's certificate.

You cannot encrypt system files or folders; an error message indicates access denied. You can ignore the message or just cancel; it is better to cancel the operation because you do not want to accidentally encrypt any file needed for boot (the boot code, hal, kernel, drivers, services, and dependencies). At boot time, there is no impersonation process and boot files cannot be decrypted. ...