If the source encryption key can be used on the target (i.e. if the target computer can access the EFS certificate somehow) the file is decrypted on the source computer, transmitted unencrypted over the network and re-encrypted with the same key on the target computer.
If that fails (e.g. the target computer cannot access the EFS certificate or EFS is disabled on the target), a new key is generated on the target and the file is encrypted with that new key.
If that fails, too, CopyFile(Ex) fails with ERROR_ENCRYPTION_FAILED unless CopyFileEx has been used and the flag COPY_FILE_ALLOW_DECRYPTED_DESTINATION has been set. Only then is the file stored decrypted on the target system.
The file is transmitted unencrypted over the network.
Do a copy of the raw encrypted data similarly to robocopy with the switch /EFSRAW. This copies the encrypted file without resorting to encryption/decryption. In order to decrypt the file on the target, the private key is required. A side effect of this is that the file is never decrypted and thus transmitted encrypted over the network.
Store the file unencrypted on the target.
I never want a file to be encrypted with a new default key (paragraph 2 above). Although generating new self-signed certificates can be turned off per server (see below), this is fundamentally wrong and may lead to new user profiles being created on the target machine.
Use the API functions CreateFile, ReadFile and WriteFile to first open the source and create the target and then read/write in chunks.
Chunk size is relevant. 512 KB seems like a good starting point when reading, 32 MB when writing.
Use the flag FILE_FLAG_NO_BUFFERING to prevent the operating system's file system cache to become filled with data that probably is not needed again soon.
Do not use FILE_FLAG_WRITE_THROUGH, because that disabled the disk's cache.
Use asynchronous IO file create an IO queue.
fsutil behavior set disableencryption 1 [Vista and newer]. This has the same effect as setting NtfsDisableEncryption to 1 (see below).
Set the value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableEncryption to 1 [DWORD].
Set the value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EFS\Efsconfiguration to 1 [DWORD].
Set the value HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\CurrentVersion\EFS\EfsOptions to 0 [DWORD]. An example for an ADM file can be found in the Microsoft KB.