| Previous | Next |
| STATUS_ENCRYPTION_FAILED | STATUS_RANGE_NOT_FOUND |
STATUS_DECRYPTION_FAILED
No usable EFS decryption path completed
An encrypted file contains encrypted data plus EFS metadata identifying users and recovery agents able to unwrap its file-encryption key. ACL ownership alone is insufficient. This status commonly means the required private key is unavailable, inaccessible, or does not match the metadata.
Preserve the encrypted file and its metadata. Reinstalling Windows, recreating a same-named account, or taking ownership does not recreate the original private key. Recovery requires a matching user key or configured data-recovery-agent key.
What to inspect
- Use cipher and EFS APIs to enumerate authorized users and recovery agents.
- Inspect certificate stores and key-provider access under the original user context.
- Restore the correct certificate and private key from protected backup before attempting bulk recovery.
References
- Microsoft: EFS file and recovery keys
- Microsoft Open Specifications: EFSRPC
- Microsoft: cipher
- libyal: NTFS format documentation
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.