ERROR_DECRYPTION_FAILED 0x1771: Fix EFS Corruption

Cause 1: Your EFS Certificate Is Missing or Corrupted

This is the cause I see 90% of the time. When you encrypt a file with NTFS encryption (EFS), Windows creates a certificate with a private key. That key lives in your user profile. If you reinstalled Windows, deleted your user profile, or moved the file to a new computer, the key isn't there anymore. Windows can't decrypt the file, and you get 0x00001771.

Here's a real scenario: You backed up your Documents folder before wiping the drive, restored it after a fresh install, and now every encrypted file throws this error. The files are fine—your key is gone.

How to Check if the Key Is Missing

1. Press Win + R, type certmgr.msc, and hit Enter.
2. Expand Personal → Certificates.
3. Look for a certificate with "Encrypting File System" in the Intended Purposes column. If you don't see one, you don't have a valid EFS certificate for this profile.

After opening certmgr.msc, you should see a list of certificates. If the list is empty under Personal, that's the problem.

Fix: Restore Your Certificate from Backup

Did you export your certificate when you set up EFS? The prompt appears the first time you encrypt a file. If you saved the .pfx file, here's how to bring it back.

1. Double-click the .pfx file. The Certificate Import Wizard opens.
2. Select Current User and click Next.
3. Click Next again—the file should already be listed.
4. Enter the password you set when exporting. Check Mark this key as exportable if you want to back it up again later. Then click Next.
5. Choose Automatically select the certificate store and click Next, then Finish.

After the import, try opening the encrypted file. If the key matches, it'll open. You may need to log off and on again for Windows to reload your profile.

No backup? Then you're stuck unless you have a recovery agent. Skip to Cause 3 for that. I'd also check if the file was encrypted by an admin account you still have access to.

Cause 2: The File Was Encrypted by Another User Account

If you're logged in as a different user than the one who encrypted the file, Windows won't decrypt it. That's by design—EFS is tied to the user profile.

This happens a lot after a domain migration. A user's profile gets recreated with a new SID, and suddenly they can't open their own files.

Fix: Log In as the Original User or Take Ownership

1. Log out and log back in as the account that originally encrypted the file. This sounds obvious, but I've seen people miss it.
2. If you can't log in as that user, you can try taking ownership of the file. This won't help if the file is encrypted—ownership doesn't grant decryption rights—but it's worth a shot if you're an admin.
3. Right-click the file → Properties → Security tab → Advanced → Change next to Owner. Type your username and click OK.

After changing ownership, try to open the file. If it still fails with 0x00001771, the decryption key isn't available to your account. You'll need to see if a recovery agent is set up.

Cause 3: No Valid Data Recovery Agent

Windows lets a designated recovery agent decrypt any EFS file on the system. In home editions, this is often the built-in Administrator account. If that account's EFS certificate is corrupt or missing, recovery fails.

How to Check for a Recovery Agent

1. Open an elevated Command Prompt: right-click Start → Command Prompt (Admin) or Windows PowerShell (Admin).
2. Run cipher /c "C:\path\to\encryptedfile.txt".
3. Look for the Recovery Agents section. If it says "None", there's no one who can recover this file.

Running cipher /c does not modify the file. It only shows encryption info. You'll see a list of user keys and recovery agents.

Fix: If You Have the Recovery Agent's Certificate

If you exported the recovery agent's .pfx file, import it using the same steps as in Cause 1, but this time in the Local Machine store. To do that:

1. Open an elevated Command Prompt and run certmgr.msc (or use mmc and add the Certificates snap-in).
2. Right-click Certificates (Local Computer) → All Tasks → Import.
3. Follow the wizard and place the certificate in the Personal store.

After importing, try the file again. If it works, export the certificate again with a password and store it somewhere safe.

No recovery agent and no backup? I'll be blunt: the data is lost. You can try brute-forcing the old tools, but the encryption is solid. Your best bet is to restore from a backup that wasn't encrypted, or from a system image taken before the key disappeared.

Quick-Reference Summary

Start with the certificate check. That's the quickest way to see if you're missing a key. And no matter what, back up your EFS certificates now. You don't want to be here again.