Data Recovrry Agent in Domain Envrnment -- plz help

[Maaz]

Windows 2003 based Active Directory Environment. All client computers are MS Windows XP.
I want to configure the Domain Administrator, Data Recovery Agent, for the entire Domain.
Please guide me ... any tutorial will be appreciated?
PS. I can configure the DRA on the single machine... but I want to configure the DRA for every single machine, within the entire Domain.

Thanks n Regards
Maaz

[Ivan Ferreira]

Is this what you need?:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_seprocsaddrecagent.mspx?mfr=true

[Maaz]

Thanks Ivan.

I read from the website (you mentioned, and try to implement, but fialed. I did the following:

ON DC:
0, Administrator logs-in
1, cipher /r:keys
2, Import/Install the "keys.pfx" file with all the default options.
3, Edit the Default Domain Policy > Computer Configuration > Windows Settings > Security Settings > Public Key Policies > Encrypting File System > Add Data Recovery Agents > Browse Folder > Open the "Keys.cer" file > Finish.

ON a client machine(xp):
1, log on to the domain with a domain user account(ordinary user), then create some files and encrypt the folder/files.

2,log on to the domain with a Administrator account, and try to read the encrypted files(encrypted by the domain user ), but Access is Denied.

Plz help. Let me know what to do.

Regards
Maaz

[Ivan Ferreira]

You must take the ownership of the file before trying to decrypt the file.

[Maaz]

Thanks Dear Ivan.
I took the ownership and have the full permission on the files/folder(Domain Users' encrypted files), but i still cant read the encrypted files. I am sure there must be something wrong in the implementation of my DRA.

Regards
Maaz