| Previous | Next |
| ERROR_EFS_SERVER_NOT_TRUSTED | ERROR_EFS_ALG_BLOB_TOO_BIG |
ERROR_BAD_RECOVERY_POLICY
The recovery policy exists but cannot be used safely
This error is more specific than ERROR_NO_RECOVERY_POLICY. Windows found recovery-policy data, but the policy is malformed, inconsistent, expired, or otherwise unusable for the EFS operation.
A common enterprise failure is an expired or invalid Data Recovery Agent certificate still published through Group Policy. Replace policy carefully: retain the old recovery private key for files encrypted while the old certificate was active, and validate the new policy on test data before broad deployment.
What to inspect
- Every certificate in the effective EFS recovery policy, including validity dates and intended usage.
- The GPO and registry policy data from which the client obtained the recovery configuration.
- Availability and backup of old and current recovery-agent private keys.
- Group Policy processing errors and differences between affected and healthy clients.
References
- Microsoft: Invalid EFS recovery certificate in policy
- Microsoft Open Specifications: EFS Recovery Policy
- Microsoft: Back up an EFS recovery-agent private key
- Microsoft: cipher command
Looking for a different code? Search another status or error code.