Fix ERROR_NO_EFS 0x00001774 Encryption Driver Not Loaded

You're staring at ERROR_NO_EFS and your encrypted files are locked. Let's get them back.

This isn't a random glitch. 0x00001774 means the Windows Encrypting File System (EFS) driver — efs.sys — isn't loaded into memory. Usually this happens after a Windows update, a registry cleaner went rogue, or you messed with group policies. I've seen it most often on Windows 10 20H2 and Windows 11 after the KB5008212 update back in 2021, but it can pop up any time.

The fix — reboot the EFS service and driver manually

Open an elevated Command Prompt (right-click Start → Command Prompt (Admin) or Terminal (Admin)).
Run these commands in order:

net stop efsvc
sc config efsvc start= auto
net start efsvc
fltmc load efs

That's it. 90% of the time this resolves the error immediately. The error code will vanish, and you can access your EFS-encrypted folders again.

If you get "The service name is invalid" on net start efsvc, skip to the alternative steps below.

Why this works

What's actually happening here is the Encrypting File System service (Efsvc) is the user-mode service that manages EFS policy and certificate operations. But the actual encryption work is done by the efs.sys file system filter driver in kernel mode. The fltmc load efs command tells the filter manager to load that driver. Without both pieces running, Windows can't decrypt anything.

The reason step 3 works is sc config efsvc start= auto sets the service to auto-start on boot. If it was disabled (common after a security tool overcorrected), this forces it back on. Then net start efsvc kicks it off in the current session. The fltmc load efs loads the driver for immediate use — even if the service starts, the driver might not load until next boot. So you do both.

If that didn't work — alternative fixes

1. The EFS service is missing from the registry

If net start efsvc says the service name is invalid, the service entry in the registry is gone. This happens after a registry cleaner deleted it, or a bad script ran. Here's how to restore it:

reg add "HKLM\SYSTEM\CurrentControlSet\Services\Efsvc" /v DisplayName /t REG_SZ /d "Encrypting File System (EFS)" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Efsvc" /v ImagePath /t REG_EXPAND_SZ /d "%SystemRoot%\System32\lsass.exe" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Efsvc" /v Start /t REG_DWORD /d 2 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Efsvc" /v Type /t REG_DWORD /d 2 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Efsvc" /v ObjectName /t REG_SZ /d "LocalSystem" /f

Then reboot. After that, the service should exist, and you can run the first set of commands again.

2. EFS is completely disabled via Group Policy

Open gpedit.msc. Go to Computer Configuration → Windows Settings → Security Settings → Public Key Policies → Encrypting File System. Right-click and choose Properties. Make sure it's not set to "Don't allow." If it is, set it to "Allow" or "Not Configured." Then run gpupdate /force in a command prompt and retry the fix above.

3. Corrupted EFS certificate

If the driver loads but you still can't access files, the certificate is probably toast. Open certmgr.msc, expand Personal → Certificates. Look for certificates with "Encrypting File System" in the intended purposes. If there's a yellow warning icon, the cert is corrupted. You'll need to back up your encrypted files using a recovery agent or a previous backup, then revoke the old cert and create a new one.

To create a new EFS certificate, run:

cipher /r:EFSRecovery

This generates a recovery certificate. Then you can access your old files by right-clicking the encrypted folder → Properties → Advanced → Details → Add a new user with a new EFS certificate. But this only works if the original user certificate still validates. If it doesn't, you're looking at data recovery from a backup.

Prevention — don't let this happen again

Stop using registry cleaners. They love deleting the EFS service key. Just don't.
Always back up your EFS certificate. Run certmgr.msc, right-click the EFS cert, All Tasks → Export, choose yes to export the private key, and save it somewhere safe (not on the same drive).
Create an EFS Data Recovery Agent via Group Policy before you encrypt anything. This is a one-time setup that gives you a backdoor. Without it, if the cert goes, your files go with it.
Check your EFS service state after major Windows updates. Run sc query efsvc after an update. If it shows STOPPED or DISABLED, run the fix commands preemptively.

Bottom line: ERROR_NO_EFS is almost always a service/driver loading issue — not dead data. The fltmc load efs trick is the one you'll remember. Use it.