: It may naturally spawn from lsass.exe if BitLocker was recently enabled or disabled, prompting the user to set a backup key.
(Encrypting File System User Interface) is a legitimate Microsoft Windows system process responsible for the graphical user interface of the Encrypting File System (EFS) . It typically appears when a user or system process attempts to encrypt or decrypt files and folders on an NTFS drive. Core Functionality efsui.exe efs installdra
EFS works via public key cryptography. When you encrypt a file: : It may naturally spawn from lsass
The command syntax burned in his memory from an old Black Hat talk: efsui.exe /installDRA /cert:"tempDRA.cer" /force efsui.exe efs installdra
The output will list all recovery agents.