Fix ERROR_EFS_NOT_ALLOWED_IN_TRANSACTION (0X00001AAF) on locked files

1. Most Common Cause: Encryption inside a Transactional NTFS (TxF) Scope

This error shows up when your code or script tries to encrypt a file with EFS (Encrypting File System) while a file transaction is active. Windows doesn't allow encryption operations inside a transaction. The transaction might be explicit (like using CreateFileTransacted) or implicit through a .NET TransactionScope.

You'll typically hit this in custom apps that use System.Transactions or in scripts that wrap file operations in a transaction. I've seen it most often when a developer does this:

using (TransactionScope scope = new TransactionScope())
{
    File.Encrypt(@"C:\Data\file.txt");
    // ERROR_EFS_NOT_ALLOWED_IN_TRANSACTION here
    scope.Complete();
}

The fix is straightforward: move the File.Encrypt call outside the transaction block. Don't try to wrap EFS operations in a transaction — it's not supported and probably never will be.

How to fix it step-by-step

1. Open your source code in Visual Studio or your editor.
2. Find the TransactionScope block (or BeginTransaction block in C++).
3. Move the File.Encrypt() or EncryptFile() call to run after scope.Complete() and Dispose().
4. If you need the encryption to be part of the same atomic operation, restructure your logic: for example, encrypt the file first, then use the transaction for the rest of the work.

After you make the change, run the app again. The error should disappear. If it doesn't, check if there's another transaction active higher up the call stack — maybe a parent transaction scope you didn't notice.

2. Second Most Common Cause: Service or Script with Implicit Transaction

Sometimes you're not using TransactionScope explicitly, but your environment has one active. This happens in:

• Windows Services that run under the Network Service account and use COM+ transactions.
• PowerShell scripts using Microsoft.PowerShell.Archive cmdlets inside a transaction — though less common.
• SQL Server Agent jobs that call xp_cmdshell to run a file encryption command while a database transaction is open.

I've seen a real case where a backup script used SqlConnection.BeginTransaction in .NET, then called File.Encrypt inside the same method. The SqlConnection enlisted in a TransactionScope automatically, causing the EFS call to fail.

How to fix it step-by-step

1. Identify where the transaction is coming from. Check the call stack or use Sysinternals Process Monitor to see what transaction handles are open.
2. Wrap the encryption call in a TransactionScope with TransactionScopeOption.Suppress to run it outside the ambient transaction:

using (TransactionScope suppressScope = new TransactionScope(TransactionScopeOption.Suppress))
{
    File.Encrypt(@"C:\Data\file.txt");
    suppressScope.Complete();
}

This forces the encryption to happen in a transaction-free context. The outer transaction continues unaffected.

After applying this, test the script or service again. The error should stop appearing.

3. Third Most Common Cause: Database Transaction Leaking into File Operations

This one trips up DBAs and devs alike. You have a stored procedure or database trigger that calls xp_cmdshell or a CLR stored procedure, which then tries to encrypt a file. Because the database call runs inside an implicit transaction (SQL Server wraps every command in a transaction by default), the EFS operation fails.

I fixed this for a client who had a trigger on an INSERT that encrypted a PDF receipt. The trigger ran inside the transaction of the insert, so every new receipt threw error 0X00001AAF.

How to fix it step-by-step

1. In SQL Server Management Studio, open the stored procedure or trigger that calls xp_cmdshell or a CLR method for encryption.
2. Wrap the encryption command in a nested transaction with BEGIN TRANSACTION and COMMIT TRANSACTION — but that won't help because EFS still sees an outer transaction. Instead, use sp_executesql with SET XACT_ABORT OFF or run the encryption in a separate SQL Server Agent job that runs asynchronously.
3. Better approach: move the encryption logic out of the database layer entirely. Have the application layer encrypt the file after the database transaction commits.

For a quick workaround (not recommended for production), you can enable xp_cmdshell and call a PowerShell script that uses TransactionScopeOption.Suppress as shown in fix #2. But the real fix is to decouple file encryption from database transactions.

Quick-Reference Summary Table