Microsoft EFS password resets

[Keith]

I'm reading about EFS (from Windows Server 2003 Security A technical Reference - pretty good), anyway a few questions.

1) It says in Windows 2000 if an admin resets a users password they can gain access to the files that the user encrypted. I also read in that book that the encryption is based off the users password. So how can an admin reset the password and be able to view the encrypted data?

2) Also it says on XP if a user forgets his/her password they can use a password reset disk, they then can gain access to their encrypted files. How does this work? It's just the same thing as resetting the password, right?

[morganlefay]

Sounds like the encryption key is stored in the profile of the user who encrypted the files....hence anyone with access to the profile can access the encrypted files

MLF