| Previous | Next |
| ERROR_DIR_EFS_DISALLOWED | ERROR_BAD_RECOVERY_POLICY |
ERROR_EFS_SERVER_NOT_TRUSTED
Remote EFS needs an authenticated and trusted delegation path
Remote EFS management is performed through EFSRPC over RPC and SMB. The client must authenticate to the server, and some remote-key scenarios require the server to be configured for appropriate Kerberos delegation. A server can be reachable as a normal file server yet still be unsuitable for the requested remote encryption operation.
Do not confuse this error with SMB 3 transport encryption. SMB encryption protects network messages; EFS protects file contents and uses user or recovery certificates. Enabling one does not establish the delegation trust needed by the other.
What to inspect
- The client and server domain identities, SPNs, and the authentication protocol actually negotiated.
- Kerberos constrained-delegation configuration for the services used by EFS key storage.
- EFSRPC connectivity through the expected named-pipe endpoint and any SMB proxy or appliance in the path.
- Whether local encryption succeeds for the same user and certificate.
References
- Microsoft Open Specifications: EFSRPC prerequisites
- Microsoft Open Specifications: EFSRPC transport
- Microsoft Open Specifications: Relationship to SMB and RPC
- Microsoft Open Specifications: EFS overview
Looking for a different code? Search another status or error code.