MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

10-52 Chapter 10 Managing Data Storage
How to Control Encryption From the Command Line by Using the Cipher
Command
The Cipher command provides the capability to encrypt and decrypt files and folders
from a command prompt. The following example shows the available switches for the
Cipher command, which are described in Table 10-5:
cipher [/e | /d] [/s:folder_name] [/a] [/i] [/f] [/q] [/h] [/k] [file_name [...]]
Table 10-5 Cipher Command Switches
Switch Description
/e Encrypts the specified folders. Folders are marked so any files that are added later
are encrypted.
/d Decrypts the specified folders. Folders are marked so any files that are added later
are not encrypted.
/s Performs the specified operation on files in the given folder and all subfolders.
/a Performs the specified operation on files as well as folders. Encrypted files could
be decrypted when modified if the parent folder is not encrypted. Encrypt the file
and the parent folder to avoid problems.
/i Continues performing the specified operation even after errors have occurred. By
default, Cipher stops when an error is encountered.
/f Forces the encryption operation on all specified files, even those that are already
encrypted. Files that are already encrypted are skipped by default.
/q Reports only the most essential information.
/h Displays files with the hidden or system attributes, which are not shown by
default.
/k Creates a new file encryption key for the user running the Cipher command. Using
this option causes the Cipher command to ignore all other options.
file_name Specifies a pattern, file, or folder.
If you run the Cipher command without parameters, it displays the encryption state of
the current folder and any files that it contains. You can specify multiple file names and
use wildcards. You must put spaces between multiple parameters.
How to Create an EFS Recovery Agent
If you lose your file encryption certificate and associated private key through disk failure
or for any other reason, a user account designated as the recovery agent can open
the file using his or her own certificate and associated private key. If the recovery agent
is on another computer in the network, send the file to the recovery agent.