| Previous | Next |
| ERROR_CLUSTER_RESOURCE_VETOED_MOVE_NOT_ENOUGH_RESOURCES_ON_DESTINATION | ERROR_DECRYPTION_FAILED |
ERROR_ENCRYPTION_FAILED
The failure is in the EFS encryption path, not ordinary file permissions alone
ERROR_ENCRYPTION_FAILED is returned when Windows cannot complete the work needed to place a file in the EFS-encrypted state. It can come directly from EncryptFile, but it is also relevant to copy operations: when the source is encrypted, CopyFile and CopyFileEx try to create an encrypted destination and preserve the source file's encryption keys.
Separate the possible layers before changing anything. The destination file system must advertise FILE_SUPPORTS_ENCRYPTION; EFS must be enabled by policy; the current security context needs an appropriate EFS certificate and private key; and the target directory must permit encryption. A failure in any of those areas is more specific than a generic access-denied diagnosis.
When the only surviving copy is encrypted, do not decrypt, replace, or rewrite its EFS metadata merely to make the copy succeed. Work on a verified duplicate and preserve the original certificates and recovery-agent keys.
What to inspect
- Record the exact API and destination path that returned the error.
- Query the destination volume for
FILE_SUPPORTS_ENCRYPTIONand check effective EFS policy. - Verify that the calling user profile contains a usable EFS certificate with its private key.
- Compare with nearby errors such as
ERROR_VOLUME_NOT_SUPPORT_EFS,ERROR_EFS_DISABLED, andERROR_NO_USER_KEYS.
References
- Microsoft: Handling Encrypted Files and Directories
- Microsoft: EncryptFileW
- Microsoft: GetVolumeInformationW
- Microsoft Open Specifications: Win32 error codes
- NTFS-3G: preserving EFS data with efs_raw
Looking for a different code? Search another status or error code.