| Previous | Next |
| ERROR_WRONG_EFS | ERROR_FILE_NOT_ENCRYPTED |
ERROR_NO_USER_KEYS
No EFS key is available to the account performing the operation
EFS protects a file-encryption key for one or more user certificates and recovery-agent certificates. The relevant certificate must include access to its private key in the identity actually running the process. A certificate copied without its private key, a service running without the user's profile, or an unavailable smart card can all produce this condition.
Do not solve the error by simply enrolling a new EFS certificate when existing encrypted files are involved. A new key can encrypt new data, but it cannot unwrap file keys that were protected only for an older certificate. Locate or restore the original private key, or use an authorized recovery agent.
What to inspect
- The process token, user SID, loaded profile, and certificate store used at the time of failure.
- Whether the certificate has an associated private key and whether its provider is accessible.
- Existing encrypted files that reference older certificate hashes.
- Recovery-agent access before any certificate rotation or cleanup.
References
- Microsoft: Adding users to an encrypted file
- Microsoft: AddUsersToEncryptedFile
- Microsoft: QueryUsersOnEncryptedFile
- Microsoft: cipher command
- Microsoft: Back up an EFS recovery-agent private key
Looking for a different code? Search another status or error code.