- Data Recovery and Private Encryption Keys in EFS
- Create Additional DRAs at the Domain and OU Levels
- Exporting the File Recovery Key
The Certificates snap-in lists all certificates held by a particular user. If you log on using the Administrator account on the first domain controller in a domain, you will see the file recovery certificate on the list.
Right-click the File Recovery icon and select the Export option from the flyout menu to start the Export Certificate Wizard. Follow the instructions on the screen to create a transportable certificate. You can select the default options at all screens. This ensures that you use a strong password for encrypting the contents of the certificate. Don't forget this password. If you forget it, you will not be able to import the key and recover files.
After you've exported the certificate, make copies on several floppies, or burn them to a CD or two. Store the copies in secure places. Then remove the File Recovery certificate from the system.
A word of caution: You may want to import the certificate to another server, just to make sure that you know how to do it and that the procedure works before you remove the key from the original server. Be sure to remove the key from the second server when you're done with the test.