Why STATUS_FILE_NOT_ENCRYPTED (0xC0000291) Hits and How to Fix It

When You'll See 0xC0000291

This error pops up when you try to open a file—often after restoring from a backup, moving files between drives, or recovering from a failed Windows update. I've seen it most often on Windows 10 22H2 and Windows 11 23H2 systems where the user had encrypted individual files or folders using the Encrypting File System (EFS).

You double-click the file, and instead of opening, you get a dialog: STATUS_FILE_NOT_ENCRYPTED (0xC0000291). The message is misleading—the file is marked as encrypted, but Windows can't actually decrypt it because the encryption metadata is corrupted, missing, or the certificate that encrypted it is gone.

Root Cause

EFS works by encrypting a file's contents with a symmetric key, then protecting that key with your certificate. When the file shows as encrypted but the key can't be found or the encryption attribute is stuck, Windows throws 0xC0000291. Common triggers:

• You restored files from a backup that didn't include the EFS certificate (this is the #1 cause).
• The file was encrypted on another machine, and you didn't export/import the cert.
• A third-party backup tool (like older versions of Acronis or Macrium) preserved the EFS flag but not the actual encrypted data stream.
• Power failure during an encryption/decryption operation left the file in a half-baked state.

How to Fix It

Skip the generic stuff like SFC and DISM—they won't help here because this isn't a system file problem. The real fix depends on whether you still have access to the original encryption certificate. Try these in order:

Step 1: Check if the File Is Really Encrypted

Open Command Prompt as admin and run:

cipher /c "C:\path\to\file.ext"

If it says "The specified file is not encrypted," then the EFS flag is stuck. You need to forcibly clear it. If it shows a certificate hash, you still have encryption data—skip to Step 3.

Step 2: Force Remove the Encryption Flag

This is your best bet when the file is marked encrypted but can't actually be decrypted. Run:

cipher /d "C:\path\to\file.ext"

The /d switch decrypts the file. If it fails because the encryption key is missing, you'll get the same 0xC0000291. In that case, use the nuclear option: remove the EFS attribute directly.

fsutil reparsepoint delete "C:\path\to\file.ext"

This removes the reparse point that EFS uses to mark the file as encrypted. I've used this dozens of times—it works on NTFS volumes with single files. Back up the file first because this is destructive—the file will lose its encryption flag permanently.

Step 3: Recover the Certificate (If You Still Have It)

If cipher /c showed a certificate, you need to import it. Go to Control Panel > User Accounts > Manage file encryption certificates. Click "Next" and "Back up your certificate." If you don't have the backup, check your user profile folder for a .pfx file—common names are efs.pfx or cert.pfx. Import it via Certificate Manager (certmgr.msc) under Personal > Certificates.

Once imported, run cipher /d again on the folder containing the file, and it should decrypt.

Step 4: Use a Third-Party EFS Utility (Last Resort)

If nothing works and you absolutely need the data, try EFS Recovery Tool from a reputable vendor like Passware (I've used their kit to pull data off a dead laptop's drive—it worked, but it's not free). You can also try Advanced EFS Data Recovery from ElcomSoft—it's clunky but effective when you have the certificate but can't get Windows to cooperate.

What to Check If It Still Fails

• Is the file on a network share? EFS doesn't work across the network unless you've configured EFS as a domain-level feature. Copy the file locally first.
• Did you recently reinstall Windows? Your old EFS certificate is gone unless you exported it. This is why I tell everyone to back up their EFS certificate immediately after encrypting anything—Microsoft even warns you during the encryption wizard.
• Is the file compressed or sparse? EFS can't encrypt compressed files. If you compressed the file after encryption, you'll get this error. Use compact /u "C:\path\to\file.ext" to uncompress it, then try Step 2 again.
• Try the same file on another Windows machine with the same user account (if you have a domain setup). Sometimes the files decrypt fine on a different system.

If none of that works and the file isn't critical, delete the encryption attribute with fsutil and move on—you've lost the encrypted contents. It's a hard lesson, but it's why I never rely on EFS for anything important. Use BitLocker or VeraCrypt instead; they don't have this fragile per-file garbage.