Procedure for Adding Users to Decrypt Your EFS Files

In our conversation about EFS encryption, I mentioned that you can allow others to view your encrypted files. Below is the procedure:

How to encrypt a file for multiple users

To do this, follow these steps:

1. Start Microsoft Windows Explorer, and then select the encrypted file that you want to add additional users to.
2. Right-click the encrypted file, and then click Properties.
3. Click Advanced to access the EFS settings.
4. Click Details to add additional users.
5. Click Add. The Add dialog box will display any other EFS-capable certificates in your personal store or those of any other users who may be in your "Other People" and "Trusted People" certificate stores.
   
   If you do not see the user who you want to add, click Find User to search Active Directory. The Select User window appears. A dialog box displays valid EFS certificates in Active Directory based on your search criteria. If no valid certificate is found for that user, a message will inform you that there are no appropriate certificates for the selected user. In this case, the intended users must send you a copy of their certificate for you to import. You can then add them to your encrypted file.
6. Select the certificate of the user who you want to add, and then click OK. You will be returned to the Details tab, and the tab will show the multiple users who will have access to the encrypted file and the users' EFS certificates.
7. Repeat this process until you have added all the users who you want to add. Click OK to register the change and continue.

Note Any user who can decrypt a file can also remove other users if the user who does the decrypting also has write permissions on the file.

Reference: http://support.microsoft.com/kb/223316, http://technet.microsoft.com/en-us/library/bb457116.aspx#EFAA