| Previous | Next |
| ERROR_CS_ENCRYPTION_FILE_NOT_CSE | ERROR_NO_BROWSER_SERVERS_FOUND |
ERROR_ENCRYPTION_POLICY_DENIES_OPERATION
An administrative encryption policy rejected the operation
This error identifies a policy decision. The file system and EFS components may be present, and the user may have valid keys, but the requested action is not allowed under the effective machine or domain configuration.
Collect the Resultant Set of Policy and determine which GPO owns the setting before changing local registry values. Also distinguish a global EFS policy denial from ERROR_DIR_EFS_DISALLOWED, which applies to a particular directory, and from ERROR_EFS_DISABLED, which disables EFS on the machine.
Applications handling regulated data should fail closed when encryption is required. Silently writing an unencrypted destination in response to this code defeats the policy that produced it.
What to inspect
- The effective EFS Group Policy settings and their source GPOs.
- Policy refresh timestamps and Group Policy processing errors.
- The precise operation denied: encrypt, decrypt, copy, remote EFS, or key management.
- Fallback behavior that might expose plaintext when policy blocks encryption.
References
- Microsoft Open Specifications: EFS Group Policy overview
- Microsoft Open Specifications: EFS Enabled Status
- Microsoft Open Specifications: EFS Recovery Policy
- Microsoft Open Specifications: Win32 error codes
Looking for a different code? Search another status or error code.