| Previous | Next |
| STATUS_WRONG_EFS | STATUS_FILE_NOT_ENCRYPTED |
STATUS_NO_USER_KEYS
No EFS key is available in the current user context
EFS protects the file encryption key for one or more users and recovery agents using their certificates. A certificate without its private key, a key stored in an unavailable profile or smart card, or execution under a service identity can all leave the current token unable to encrypt or decrypt.
Identify the user SID and profile that owns the required key. Do not export or replace certificates before checking existing encrypted files, because a newly enrolled certificate does not decrypt data protected only for the old key. Use a configured recovery agent when the original private key is lost.
What to inspect
- Enumerate EFS certificates and verify private-key availability for the current user.
- Check profile loading, key-container permissions, and smart-card or provider state.
- Preserve old certificates and use recovery-agent access before rotating keys.
References
- Microsoft: Encrypting File System
- Microsoft: Adding users to an encrypted file
- Microsoft: cipher command
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.