STATUS_FILE_ENCRYPTED (0XC0000293) Fix: File Encrypted, Can't Decrypt

What's Actually Happening Here

You're seeing STATUS_FILE_ENCRYPTED (0XC0000293) — the OS is telling you: "This file is locked with encryption, and you don't have the key." Most of the time, this is Encrypting File System (EFS) on Windows. It's built into Pro and Enterprise editions. Someone encrypted the file, then either lost their certificate, reinstalled Windows, or moved the file to a different machine.

I've seen this pop up when a client's IT guy encrypted their shared drive "for security" and then quit the company without exporting the EFS certificate. Also happens when you copy encrypted files to a USB drive and try to open them on a different PC. Ransomware can throw this error too — but that's usually paired with a ransom note. If there's no note, assume it's EFS.

Let's fix this. Start with the quick check, then work up.

Quick Fix (30 seconds) — Check If You Already Have the Certificate

Sometimes the cert is still in your certificate store but just not associated with that file. Open a command prompt as admin and run:

cipher /c \"C:\Path\To\YourFile.ext\"

Replace the path with your actual file. This shows the encryption details — including the certificate thumbprint and whether it's recoverable.

Look for "Unable to decrypt" or "No matching certificate found". If you see a thumbprint listed under "Recovery Certificates" or "Certificates that can decrypt the file", and it says "This file can be decrypted", you're golden. Run:

cipher /d \"C:\Path\To\YourFile.ext\"

That permanently decrypts the file. If the cipher command says "Access Denied" or "No certificate", move to the moderate fix.

Moderate Fix (5 minutes) — Find the EFS Certificate and Re-Import It

If you encrypted the file on this same PC but reinstalled Windows, your old certificate might still exist if you backed it up. Check these places:

• Your backup drive or cloud storage — look for a .pfx or .p12 file.
• Old Windows.old folder — if you upgraded instead of clean-installing, the cert might be at C:\Windows.old\Users\YourUsername\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates
• Certificate store of another user account — try logging in as a different admin user and running certmgr.msc to check.

To import a .pfx file:

1. Double-click the .pfx file.
2. Choose Local Machine (not Current User).
3. Enter the password (if you don't know it, try empty or the user's old password).
4. Place it in Personal certificate store.

After import, run the cipher /d command from the quick fix again. Should decrypt now.

Advanced Fix (15+ minutes) — Use the EFS Recovery Agent or Bypass the Encryption

If you can't find the certificate anywhere, you've got two real options:

Option A: Set Up a Recovery Agent (If You Have Domain Admin Access)

If this is on a domain, the domain admin can configure a recovery agent. That's a special EFS certificate that can decrypt any EFS file on the domain. Run as domain admin on a DC:

cipher /r:C:\RecoveryCert

That generates a .pfx and .cer file. Import the .cer into the domain's Group Policy: Computer Configuration > Windows Settings > Security Settings > Public Key Policies > Encrypting File System. Then import the .pfx into the administrator's personal store on the machine with the encrypted file. Run cipher /d again.

Option B: Copy the File as a Different User (Bypass Attempt)

This won't decrypt the file, but might let you move it. Create a new local admin account, log into it, and try to copy the file. Sometimes the NTFS permissions are separate from the encryption — you can copy the encrypted blob to a different location, then run cipher /d from an account that has the cert. Won't work if the file is in a system folder or you don't have read access.

Option C: Last Resort — Accept the Loss

If none of the above works, you're looking at a data recovery service. They can sometimes extract the file without decryption, but the content stays encrypted. If the file is critical (like financial records), send it to a recovery lab. Expect to pay $300-$1000. For anything else, cut your losses and restore from backup.

Prevention for Next Time

Export your EFS certificate right now if you ever intend to encrypt files again. Run:

certmgr.msc

Go to Personal > Certificates. Right-click the one with "Encrypting File System" in the Intended Purposes, choose All Tasks > Export. Choose Yes, export the private key, set a strong password, save the .pfx file to a secure USB drive and a cloud backup. Trust me — I wasted a Saturday helping a small law firm recover client files after their one IT guy encrypted a shared drive with no backup. Don't be that guy.

If you're still stuck after trying all this, you might have ransomware. Look for ransom notes (DECRYPT.txt or HOW_TO_DECRYPT.html). If so, don't pay — restore from backup or contact law enforcement. But 9 times out of 10, this error is just EFS and a missing cert. Solve that, and you're back in business.