What does Windows error code 6011 (ERROR_EFS_SERVER_NOT_TRUSTED) mean?

 
Previous Next
ERROR_DIR_EFS_DISALLOWED ERROR_BAD_RECOVERY_POLICY

ERROR_EFS_SERVER_NOT_TRUSTED

Remote EFS needs an authenticated and trusted delegation path

Remote EFS management is performed through EFSRPC over RPC and SMB. The client must authenticate to the server, and some remote-key scenarios require the server to be configured for appropriate Kerberos delegation. A server can be reachable as a normal file server yet still be unsuitable for the requested remote encryption operation.

Do not confuse this error with SMB 3 transport encryption. SMB encryption protects network messages; EFS protects file contents and uses user or recovery certificates. Enabling one does not establish the delegation trust needed by the other.

What to inspect

  • The client and server domain identities, SPNs, and the authentication protocol actually negotiated.
  • Kerberos constrained-delegation configuration for the services used by EFS key storage.
  • EFSRPC connectivity through the expected named-pipe endpoint and any SMB proxy or appliance in the path.
  • Whether local encryption succeeds for the same user and certificate.

References


Looking for a different code? Search another status or error code.