How EFS works

By default EFS uses DESX (56-bit) in Windows 2000 and DESX (128-bit) in Windows XP. Windows XP SP1 and higher use AES (256-bit) by default. Optionally 3DES (168-bit) in Windows XP and Windows 2003 (and Windows 2000 with High Encryption Pack) may be used.

All of these algorithms make use of a random cipher key so they present a fairly strong encryption. The Average Joe is not going to crack this thing in any reasonable amount of time. Also note that 3DES complies with Federal Information Processing Standards (FIPS 140-1 Level 1) and is significantly stronger than the default DESX encryption. You have to enable the use of 3DES. I'll show you that later in this article as well.

Keep in mind that EFS works off of your Windows account credentials. The stronger your Windows password, the more secure your encryption is going to be.

Even with its higher level of protection, EFS is not without limitations. If your logon credentials ever become compromised, EFS can be rendered fairly useless. EFS also works with a file's ACL provided by NTFS. Since EFS is dependent upon the file system, copying an EFS protected file to a non-NTFS volume will effectively remove its security as well.

Even copying a file across NTFS volumes in Windows will remove its protection. So EFS alone is not enough. To properly secure your data, you must also set up the proper access control policies as well.

In the event that you lose your EFS key backup or the encrypting account becomes corrupted, you can assign another user to act as a Data Recovery Agent. This is required in Windows 2000 and it defaults to the Domain Administrator in a domain environment. Selecting a DRA is optional in Windows XP.