ERROR_FILE_ENCRYPTED (0x00001772) File Access Denied Fix

Cause 1: Missing EFS Certificate

This is by far the most common reason you'll see error 0x00001772. The file was encrypted using the Encrypting File System (EFS) on Windows, but the certificate that holds the decryption key isn't in your user profile anymore. This happens when you get a new computer, reinstall Windows, or log in with a different user account.

Here's the kicker — EFS ties encryption to a specific Windows user account and the certificate it creates. If that account is gone or the certificate is deleted, the file is effectively locked forever.

How to fix it: Restore your EFS certificate

1. Open the old user profile folder on your drive (usually C:\Users\OldUsername). You'll need admin rights to browse it.
2. Look for a file named EFS.pfx or EFS.cer. It's often in AppData\Roaming\Microsoft\Crypto\RSA or just sitting in the user's Documents folder.
3. If you find it, double-click the .pfx file. This starts the Certificate Import Wizard.
4. When it asks for the password, enter the one you set when you backed up the certificate. If you don't remember it, there's no way around this — the data is gone.
5. After importing, right-click the encrypted file, go to Properties > General > Advanced, and uncheck Encrypt contents to secure data. Click OK and Apply. The file decrypts automatically.

If you don't have that backup, skip to Cause 2. You can't brute-force EFS, and no third-party tool can crack it. That's a hard truth.

Cause 2: EFS Recovery Agent Is Missing or Misconfigured

If the file was encrypted on a corporate domain, the system admin might have set up a recovery agent. That agent is a user account (usually Domain Admin) that holds a special certificate allowing decryption of anyone's EFS files on that network. When the recovery agent certificate is missing or expired, you get the same 0x00001772 error.

You'll usually see this error on shared network drives or when you're trying to access files from a previous employee's profile.

How to fix it: Check and apply the recovery agent

1. Open a Command Prompt as Administrator (right-click Start, select Command Prompt (Admin)).
2. Run this command to see the current EFS recovery policy:

   cipher /recovery:drive_letter:C

   Replace C with the drive letter where the encrypted file sits. This lists the recovery agents for that volume.

3. If it shows no recovery agents, you need to add one. On a domain, contact your IT admin to deploy a recovery agent certificate via Group Policy.
4. If you are the admin and have the recovery agent certificate file (.cer), import it using the Certificate Manager (run certmgr.msc). Go to Personal > Certificates, right-click, choose All Tasks > Import, and follow the wizard.
5. Once the recovery agent certificate is back, try opening the file again. If it still fails, run cipher /d "C:\Path\To\File" as admin to force decryption using the recovery agent.

Note: This only works if the file was originally encrypted while the recovery agent policy was active. If it wasn't, the recovery agent can't help you.

Cause 3: File Permissions or Ownership Conflict

Sometimes the encryption is fine, but the NTFS permissions are messed up. Your user account might not have Read or Write access to the file, even though the EFS certificate is valid. Windows checks both the EFS decryption key and the NTFS ACL. If either fails, you get the error.

This is common when you copy encrypted files from another computer's backup using a different user account, or when the file owner is a deleted user.

How to fix it: Take ownership of the file

1. Right-click the encrypted file or folder, choose Properties, then the Security tab.
2. Click Advanced at the bottom. Next to Owner, click Change.
3. Type your username (e.g., YourName or DOMAIN\YourName), click Check Names to verify it, then click OK.
4. Check the box Replace owner on subcontainers and objects if it's a folder. Click Apply.
5. Back on the Advanced Security Settings window, click Add under Permission Entries. Choose Select a principal, enter your username, and click OK.
6. In the Basic permissions list, check Full control. Click OK twice to close everything.
7. Now try opening the file. If it still says 0x00001772, use the EFS decryption method from Cause 1. The permissions fix only removes the ACL block — it doesn't give you the EFS key.

Quick-Reference Summary

The key takeaway: EFS is tough. Without the original certificate, you're out of luck. Back up EFS keys the moment you encrypt anything. Otherwise, this error is a dead end.