Not only is EFS easy to use, it is also easy to administer. Windows 2000 Professional provides administrative tools to provide advanced features as well as recovery keys and policies, which allow administrators to recover encrypted files if a user loses his or her encryption certificate and associated private key or if he or she leaves the organization. Network administrators can configure recovery policies on the domain. Users with computers that aren't connected to a network domain can also recover encrypted files. EFS generates a self-signed recovery certificate, including its associated private key, the first time a user logs on to the computer as the administrator, making that user the default recovery agent (the user capable of restoring encrypted files).