Windows’ Encrypted File System (EFS for short) is showing its age. Although it’s still very easy to use – just right-click on a file or folder and select Properties > Advanced > Encrypt contents to protect data – the risk of losing the decryption key is still pretty high.
Unlike BitLocker, which encrypts an entire drive, EFS is designed to protect individual files and folders. This can be useful in some situations, but it also means that users may not always be aware of which data they have encrypted.
That’s why most folks switched to alternatives like BitLocker, which comes with Windows, or VeraCrypt. The danger with using EFS is that you might encrypt important data, then delete your account and forget to backup the key beforehand.
Unfortunately, there’s no way to decrypt data again after that. Especially on company PCs or computers used by multiple people. That’s why we recommend you disable the use of EFS. It reduces the risk of inadvertently encrypting files that could become inaccessible later. Before doing that though, you should check if your files are already encrypted.
The best way to do this is with the Search My Files tool from Nirsoft. After you’ve downloaded the software (no installation required!), double-click the Searchmyfiles.exe file. Next, in the Search Options window (under the Attributes section), set the Encrypted option to Yes. Click Start Search.
If the search yields no results, everything is fine. Otherwise, you should try to decrypt the encrypted files so they’re not lost after disabling EFS. Next, type Group Policy into the search box on the taskbar and click Edit Group Policy.
(By the way, the Group Policy Editor is only included in Windows Pro, as well as the Education and Business editions of the operating system.)
Now click on Computer Configuration and navigate to Windows Settings > Security Settings > Public Key Policies. Right-click on the Encrypting File System folder and select Properties. Under File encryption with EFS (Encrypted File System), select the Do Not Allow option and close the window with OK.
If you now try to encrypt a file or folder in File Explorer using EFS, you’ll receive an error message when confirming with OK. It should read: File encryption is disabled on this computer.
