One last area we need to investigate is how to disable EFS. Quite simply, if not managed properly, EFS could become more of a headache than anything else. Though you might think it would be as simple as changing a checkbox somewhere, unfortunately that’s not the case. It isn’t that hard anyhow, but you need to understand the repercussions of what you’re doing. The way that EFS is disabled is by either removing the recovery agents (which is considered having an empty policy), or by applying no policy at all. Although the two look similar, they are actually different in how they behave. Recovery agent policy settings can be set at the domain, OU and local levels.
| No Policy | Empty Policy | |
| System without domain membership | Disables EFS | Disables EFS |
| System with domain membership | Depends on OU and domain settings | Depends on OU and domain settings |
As far as OU and domain recovery policies are concerned, both ‘no policy’ and an ’empty policy’ will have different outcomes because of how recovery policy settings are inherited.
Having no policy applied disables policy at whichever level it were set. For example, if you had no policy applied at the domain level, it would only apply to computers at that level, and any lower level policies (such as OU or local policies) would still take effect.
Applying an empty policy at any level disables EFS at that level and all lower levels as well.
As such, if you wanted to disable EFS throughout an entire domain, the easiest way would be to simply remove all recovery agents from the domain-level policy, leaving it empty.
And there it is. EFS, while easy to configure for the user, certainly involves a little more consideration from the System Admin. I hope this article has provided you with a solid overview of EFS, a better understanding of how it actually works, and some important details about how it might impact you in your day-to-day dealings with Windows 2000.
