Looking for high level steps to configuring domain based EFS in a 2008 R2 forest running XP clients ? want to avoid users being able to use EFS with self-signed certs when CA not available. thanks in advance.

Please consider configuring a domain based Data Recovery policy for EFS using centralized data recovery agents (DRA). For more details and instructions about the subject please refer to Encrypting File System 2008 & 2008 R2 http://technet.microsoft.com/en-us/library/cc749610(WS.10).aspx Encrypting File System in Windows XP and Windows Server 2003 http://technet.microsoft.com/en-us/library/bb457065.aspx /Hasain