STATUS_WRONG_EFS (0XC000028F) – Encrypted File Won’t Open? Here’s the Fix

When This Error Happens

You’re trying to open a file – maybe an old QuickBooks backup or a client’s sensitive PDF – and Windows throws 0XC000028F with “STATUS_WRONG_EFS – The file was encrypted with a different encryption driver than is currently loaded.” Your first thought: “Did I just lose this data?”

I’ve seen this most often after a system restore from a backup that used a different EFS (Encrypting File System) provider. Maybe you migrated from an older Windows version, swapped out a motherboard, or restored files from a drive that had a different EFS certificate loaded. It’s also common when someone encrypts files on a domain-joined machine and then tries to open them on a workgroup PC – the EFS driver from the domain environment isn’t available.

What’s Actually Going On

EFS in Windows uses a per-user certificate and a driver to encrypt and decrypt files. That driver is tied to the system’s cryptographic provider. If the file was encrypted on a machine with a different EFS driver – maybe an older crypto provider or a different hardware setup – Windows can’t find the right driver to decrypt it. The error isn’t about the key itself (usually), it’s about the driver that handles the encryption algorithm. Think of it like trying to read a book in a font your computer doesn’t have – the words are there, but the system can’t render them.

In my experience, the most common scenario: a client restored files from a Windows 7 backup onto a Windows 10 machine. The old EFS driver (like efs.sys from a different build) isn’t compatible. The file’s metadata says “this was encrypted by EFS driver version X,” and your current system only has version Y.

The Fix: Re-encrypt with the Current Driver

Here’s the ugly truth: you can’t just “fix” the driver mismatch on the existing file. You need to decrypt it (if you still have the original key) or re-encrypt it with the current driver. If you don’t have the key, you’re in trouble. But if you do – and you should, because you backed it up, right? – here’s how to get that file back.

1. Back up your current EFS certificate and key. Open certmgr.msc, go to Personal > Certificates. Find the one with “Encrypting File System” in the Intended Purposes column. Right-click, export it (including private key) to a PFX file. Safe this somewhere safe. If you don’t have this, you’ll need to locate the old certificate from the original machine.
2. Get the old EFS certificate. If you still have the original system’s backup or a working drive, export that certificate the same way. Import it on your current machine by double-clicking the PFX file. Place it in Personal > Certificates.
3. Decrypt the file. Right-click the file, Properties > Advanced > “Encrypt contents to secure data” should be checked. Uncheck it, click OK, then Apply. If the old certificate is in place, Windows will decrypt it automatically. If not, you’ll get another error – and you’ll need to use command-line.
4. Command-line option (if step 3 fails): Open Command Prompt as admin. Run cipher /d "C:\path\to\your\file.ext". This forces decryption using the current EFS provider. The /d flag tells it to decrypt. It will use whatever certificate is available. If your old cert is imported, this often works.
5. If still stuck – re-encrypt with current driver. Copy the file to a folder that’s not encrypted. Create a new folder, set it to be encrypted (right-click folder > Properties > Advanced > Encrypt). Drag the file into that folder. Windows will try to encrypt it with the current driver – and since it’s already encrypted, it might fail. But sometimes this triggers a re-encryption event. Honestly, I’ve only seen this work once with a similar error (not this exact one).

Still Failing? Check This

If none of that works, you probably don’t have the original EFS certificate. The driver error is a red herring – you actually need the key. Check your backups for a PFX file. Look in event logs under Applications and Services Logs > Microsoft > Windows > EFS – it might tell you the thumbprint of the missing certificate. If you can’t find it, you’re out of luck. No key, no file. That’s the hard lesson with EFS – it’s tied to the user account and system, not the file itself.

Had a client last month who had this exact error on a 10-year-old Excel file from an old domain. We had to restore the entire domain controller backup just to get the certificate. Not fun. So yes – export your EFS certificate now. Don’t wait until you see 0XC000028F.