What does Windows error code 6001 (ERROR_DECRYPTION_FAILED) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: ERROR_DECRYPTION_FAILED the specified file could not be decrypted.

Previous	Next
ERROR_ENCRYPTION_FAILED	ERROR_FILE_ENCRYPTED

ERROR_DECRYPTION_FAILED

Decryption requires a matching private key, not just NTFS access rights

EFS stores the file-encryption key for authorized users and recovery agents. A caller can have permission to open the file name and still be unable to recover the content when the corresponding private key is missing, inaccessible, or belongs to another user profile.

Identify the certificate hashes recorded for the file before enrolling or replacing certificates. A newly created EFS certificate does not decrypt data whose key was wrapped for an older certificate. The correct recovery path is the original user's private key or an authorized Data Recovery Agent key that was present when the file was encrypted.

For backup software, distinguish ordinary decryption from raw EFS backup. OpenEncryptedFileRaw and ReadEncryptedFileRaw can preserve encrypted data without exposing plaintext, provided the raw stream and its EFS metadata remain intact.

What to inspect

Use EFS key-query APIs or cipher to identify users and recovery certificates associated with the file.
Confirm that the required private key is present and usable in the actual process identity and loaded profile.
Check smart-card, key-provider, roaming-profile, and service-account context when the certificate exists but cannot be used.
Preserve the encrypted file and old key material before testing recovery.

References

Looking for a different code? Search another status or error code.