A type of public key Group Policy object () used by Encrypting File System () that provides for one or more user accounts to be designated as recovery agents.