A department requires EFS to protect data in a shared folder on a Windows Server 2022 file server. Users already have EFS certificates via autoenrollment. You must ensure recoverability by administrators and encrypt existing files in the folder and all subfolders. What should you do? Choose two actions.

To ensure recoverability, a Data Recovery Agent (DRA) is essential. Configuring a DRA via a domain GPO by adding a DRA certificate under 'Encrypting File System' and linking it to the OU containing the file server allows administrators to decrypt files encrypted by any user if their key is lost. This centralizes recovery. Issuing EFS Recovery Agent certificates individually and importing them is not scalable or efficient for a domain environment. To encrypt existing files and subfolders, the cipher /E /S:<FolderPath command is used. The /E switch encrypts, and /S applies the action to subfolders. The prompt states users already have EFS certificates, so enabling autoenrollment is unnecessary. Using cipher /S to decrypt would be counterproductive as the goal is to encrypt.