sqldesigner,

I will need to re-verify under a full domain model, but I dont believe you are correct re the data recovery admin group etc. The encryption key seems to be based around the SID of the user and the server's specific install. Therefore, NO other user can gain access to the file, no matter what you try, this applies to other 'administrators'. I will discuss this with some sysadmin friends of mine that use EFS extensively and see what they have to say.

Cheers

Ck