Who can decrypt EFS files?

Question

I'm running Windows 7 Professional at home and decided to encrypt some of my files using the built-in EFS. My understanding is that only the account that encrypted the files can also read them again - any other user (even administrators) cannot read them. (And of course access is completely lost after a reinstall.)

Is that correct? What users exactly can decrypt the files I secured? And out of curiosity, was that different in previous versions of Windows? I wonder since I recently read "administrators can decrypt any files" at some site stated by a Microsoft employee.

Answer 1

In short:

The user and the local administrator (if he is a Data Recovery Agent)

In detail:

At Basic ideas

However, the cryptography keys for EFS are in practice protected by the user account password.

Source: Wikipedia

This password is also stored in the SAM, which is encrypted with a system key...

Which means that not only the user can access it! Here are the details:

At Decrypting files using the local Administrator account

In Windows 2000, the local administrator is the default Data Recovery Agent, capable of decrypting all files encrypted with EFS by any local user. EFS in Windows 2000 cannot function without a recovery agent, so there is always someone who can decrypt encrypted files of the users. Any non-domain-joined Windows 2000 computer will be susceptible to unauthorized EFS decryption by anyone who can take over the local Administrator account, which is trivial given many tools available freely on the Internet.

In Windows XP and later, there is no default local Data Recovery Agent and no requirement to have one. Setting SYSKEY to mode 2 or 3 (syskey typed in during bootup or stored on a floppy disk) will mitigate the risk of unauthorized decryption through the local Administrator account. This is because the local user's password hashes, stored in the SAM file, are encrypted with the Syskey, and the Syskey value is not available to an offline attacker who does not possess the Syskey passphrase/floppy.

Source: Wikipedia

This hasn't changed towards Windows 7, if you want to know feature changes see this Wikipedia portion.