NTSTATUS 0xC0000293 (STATUS_FILE_ENCRYPTED): meaning and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: STATUS_FILE_ENCRYPTED the specified file is encrypted and the user does not have the ability to decrypt it.

Previous	Next
STATUS_NOT_EXPORT_FORMAT	STATUS_WMI_GUID_NOT_FOUND

STATUS_FILE_ENCRYPTED

Encryption succeeded at protecting the data from this security context

STATUS_FILE_ENCRYPTED is not a generic file permission failure. EFS encrypts file data and normal access yields usable plaintext only when Windows can use the required EFS key material for the caller. The current user or process can reach the file object yet still lack the ability to decrypt its contents.

For backup and recovery, Windows provides raw encrypted-file functions. They transfer the encrypted streams and EFS metadata without requiring the backup process to decrypt the file; the documented export path can use backup privilege and the import path can use restore privilege. That is fundamentally different from trying to open the file as plaintext.

Do not remove encryption metadata, overwrite the file, or substitute another certificate as a diagnostic experiment. First preserve the encrypted file and identify the user, recovery-agent, certificate, and private-key material that originally made decryption possible. A successful raw backup proves that ciphertext can be preserved, not that the application can decrypt it.

What to inspect

The user or service security context performing the normal file read.
EFS certificates and private keys available to the user or configured recovery agents.
Whether the application needs plaintext access or only an EFS-preserving backup and restore workflow.

References

Looking for a different code? Search another status or error code.