| Previous | Next |
| ERROR_DECRYPTION_FAILED | ERROR_NO_RECOVERY_POLICY |
ERROR_FILE_ENCRYPTED
The file is encrypted even if its ACL appears to allow access
ERROR_FILE_ENCRYPTED indicates that EFS protection is the blocking condition. NTFS discretionary access control and EFS key access are separate checks: granting read permission or taking ownership does not create the private key needed to unwrap the file-encryption key.
Confirm the encryption state with FileEncryptionStatus or the encrypted file attribute, then identify which users and recovery agents are recorded for the file. If the current application only needs to back up the object, use the raw encrypted-file APIs instead of attempting to read plaintext.
Do not remove the encrypted attribute or copy only the visible data stream with tools that do not preserve EFS metadata. Losing the metadata that contains wrapped keys can make later recovery impossible even when a valid private key is found.
What to inspect
- The file's encryption status and the exact account under which the failing process runs.
- The certificate and private-key availability for every listed EFS user or recovery agent.
- Whether a backup, migration, antivirus, or indexing tool should use raw EFS access instead of normal reads.
References
- Microsoft: FileEncryptionStatusW
- Microsoft: Encrypted-file backup and restore
- Microsoft: QueryUsersOnEncryptedFile
- Microsoft Open Specifications: File attributes for encrypted streams
- libfsntfs: NTFS format documentation
Looking for a different code? Search another status or error code.