EFS recovery agent

Question

Hello Geeks,
In windows 2012R2 CA , I duplicated recovery efs agent template , then in security tab added my agent and grant enroll and autoenroll,
in properties of CA server , added the recovery agent,
but in gpmc , when I want to add my agent to recovery agent , it shows me that no certificate available!!!!!!
please someone help me??
thanks in advance

Answer 1

I think you are confusing Key Recovery and Data Recovery agents:
In the properties of the CA in certsrv.msc you add a KRA (you change a registry key at the CA after you read KRA's certificates from an object on config. container). This will allow storing users' private keys in the CA DB - it can be used as an alternative
to DRAs but it is unrelated to the DRAs in the GPO.
In order to add the DRAs to a GPO their certificates need to be published the agent users' objects in AD (option Publish certificate to AD needs to be selected in the template) or you need to have the certificates as files. I would prefer the latter not
to complicate things now. So if you have issued proper EFS Recovery certificates
export their certificates from the CA DB (Issued Certificates) or from those agents' personal stores as CRT files and import them to the GPO.
But make sure that these are really EFS Data Recovery certificates and not Key Recovery certificates, otherwise data recovery will not work. The extended key usage should include File Recovery.
Elke