efs certificate expired

When attempting to encrypt a file with EFS on a xp SP2 pc an error message
occurs, "Recovery policy configured for this system contains invalid
recovery certificate". The pc is part of a domain which has an EFS policy
holding an expired cert. I'm guessing that the pc is trying to use it,
although, I can't tell that from the pc. This happens on 2 pcs in the
domain and doesn't on a pc that isn't in the domain. All documentation says
renew or get a new cert.

How do I find out which cert to renew, or which is being used for EFS?
How can I renew or add another cert to the domain policy?

Thanks,
Matt