EFSDump

Users can share EFS-encrypted files by adding other user certificates to a file. However, auditing the users who have rights to files would be very time-consuming using the Windows Explorer graphical interface. To list users who have access to encrypted files more easily, use EFSDump, available for download from http://technet.microsoft.com/en-ca/sysinternals/bb896735.aspx.

For example, to list the users who have access to files in the encrypted subfolder, run the following command.

Efsdump -s encrypted

  EFS Information Dumper v1.02
  Copyright (C) 1999 Mark Russinovich
  Systems Internals - http://www.sysinternals.com

  C:\Users\User1\Documents\Encrypted\MyFile.txt:
  DDF Entry:
    COMPUTER\User1:
	User1(User1@COMPUTER)
  DDF Entry:
    COMPUTER\User2:
	User2(User2@COMPUTER)
DRF Entry: