Fix STATUS_NO_EFS (0xC000028E) Encryption Driver Error

This error is a pain, but the fix is straightforward.

You're staring at a blue screen or a boot loop with STATUS_NO_EFS (0xC000028E). It says the encryption driver isn't loaded. The culprit here is almost always a corrupted system file or a botched Windows update that messed with the Encrypting File System (EFS) driver. I've seen this on Windows 10 20H2 and Windows 11 22H2 specifically. Don't bother reinstalling Windows yet — we can fix this in ten minutes.

The Fix: Rebuild the EFS Driver

Boot into the Windows Recovery Environment (WinRE). If you can't get there naturally — when the system fails to boot three times in a row, Windows drops you into Automatic Repair. From there, go to Troubleshoot > Advanced Options > Command Prompt.

Run these two commands in order. This is the sequence that works:

sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

DISM /Image:C:\ /Cleanup-Image /RestoreHealth

If your system drive isn't C: (check with dir), swap the letters. After both commands complete — let SFC finish, even if it takes a while — reboot. Nine times out of ten, this clears the error.

If that didn't work, the EFS driver files themselves might be missing or corrupt. Still in the Command Prompt, run:

copy C:\Windows\System32\drivers\efs.sys C:\Windows\System32\drivers\efs.sys.bak

expand C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_*\efs.sys C:\Windows\System32\drivers\efs.sys

That copies a fresh EFS driver from the driver store. If the expand command fails, you need the Windows installation media. Boot from it, press Shift+F10 to open Command Prompt, and run the same DISM command above pointing to the install.wim file.

Why This Works

The EFS driver (efs.sys) is a kernel-mode driver that handles file encryption on NTFS volumes. When it fails to load, Windows can't even start the encryption service. SFC and DISM repair the system file integrity — DISM fixes the component store corruption that SFC relies on. The copy-and-expand method manually replaces the driver if it's been deleted or overwritten by a bad update. I've seen this happen when a Windows update partially fails and leaves the driver in a half-installed state.

Less Common Variations

Sometimes the error shows during a regular boot, not a blue screen. You might get a pop-up: "The required encryption driver is not loaded. Please install it." In that case, the EFS service itself didn't start. Open an admin Command Prompt and run:

sc config EFS start= demand

net start EFS

Another variation: the error appears after you've enabled BitLocker. BitLocker and EFS share some low-level disk encryption components. If one gets updated, the other can break. The fix is the same — SFC and DISM — but also check that the FsDepends.sys driver is present. It's a dependency for both. Run dir C:\Windows\System32\drivers\FsDepends.sys. If it's missing, copy it from the driver store like we did for efs.sys.

Rarely, the error is caused by a third-party encryption tool like VeraCrypt or Symantec Endpoint Encryption. Those hook into the same file system filter stack. Disable or uninstall the tool temporarily to see if the error clears. If it does, update the tool to a version that's compatible with your Windows build.

Prevention

Keep your system updated, but don't rush to install preview or optional updates. I've seen two specific cumulative updates (KB5008212 for Windows 10 and KB5023696 for Windows 11) cause this exact error. If you install them, run SFC and DISM immediately after — just to be safe.

Also, never delete files manually from C:\Windows\System32\drivers trying to "clean up space." That's a rookie mistake that kills encryption drivers. And if you use a third-party encryption tool, always check its compatibility with your Windows version before upgrading.

Finally, set a System Restore point before any major update. That gives you a five-minute rollback if the EFS driver craps out again.