| Previous | Next |
| ERROR_FILE_READ_ONLY | ERROR_EFS_SERVER_NOT_TRUSTED |
ERROR_DIR_EFS_DISALLOWED
The directory carries an EFS-disable setting
Windows exposes EncryptionDisable to disable or re-enable encryption for a directory. When encryption is disabled, EncryptFile fails for that directory and files within it with ERROR_DIR_EFS_DISALLOWED. This is a directory-specific control, not the same as machine-wide ERROR_EFS_DISABLED.
Trace who set the directory state and why before re-enabling it. Installers, protected system locations, and administrative policy may deliberately prevent EFS use. Calling EncryptionDisable on a file is itself invalid; the API applies to directories.
What to inspect
- The nearest parent directory on which encryption was disabled.
- Deployment scripts, security products, or administrative tools that call
EncryptionDisable. - Whether the target also has the system attribute or belongs to a protected operating-system location.
- The difference between this directory control, volume capability, and global EFS policy.
References
- Microsoft: EncryptionDisable
- Microsoft: EncryptFileW
- Microsoft: Handling Encrypted Files and Directories
- Microsoft Open Specifications: Win32 error codes
Looking for a different code? Search another status or error code.