If any third party (such as the IT admin) needs to have access to the files in addition to the owner, the standard solution is to have the third party's public key on each user's keychain, and add the third party as a "recipient" of the file when encrypted. For example, user "userguy" might encrypt a file thus: pgp -se -r userguy -r itadmin a_file.example (that's actually GnuPG / gpg syntax but I believe PGP's command line syntax is compatible). The admin could then decrypt the file using their own private key (for which they'd have the passphrase), and - assuming the admin has every user's public key - re-encrypt the file (if needed) using the exact same command (changing the user's identity for each different user's files, of course).
PGP should come with an "agent" program that supports caching the decrypted (post-passphrase) key of the current user - such as the admin - in RAM, so the key only needs to be entered once per bootup. This is of course slightly riskier, since it increases the time the key spends in RAM and thus might be subject to hijacking by a malicious program or hardware attack (physical or via something like SPECTRE) - but it's a lot more convenient for somebody who has to decrypt and then re-sign (as part of re-encrypting) files all the time.
