Windows – How to disable Encrypting File System

efsencryptionwindows 7

I accidentally (believe it or not) enabled Encrypting File System on Windows 7 that uses my personal certificate. I don't need the encryption, and I don't want to be stuck with inaccessible files in the future.

After the process was done, there was no "Cancel" button. I found that the Startup type should be disabled for EFS in services.msc.

Is this the correct solution? I'm asking to be 100% sure before I end up losing my data after rebooting my PC or deleting the certificate.

Best Answer

I wouldn't say it's correct.

EFS isn't really something you need to enable or disable globally – it's the individual files that can be marked as "encrypted" or not. Newly created files are encrypted only if their parent folder is has encryption enabled.

But if you disable the EFS service, your files won't magically decrypt themselves – they'll remain encrypted, and more importantly inaccessible because you just disabled the software that could decrypt them.

So instead just disable the "Encrypted" option for your folders and files, and keep the service as is. (You can use cipher /d /s:C:\ * to mass-decrypt everything in C:\.)

Related Solutions

Windows Vista EFS – Find Out What’s Encrypted

You can trying using this batch file :

@echo off
cls

:: Set the varibles - Use Quotes "" if there are spaces in the source or log path
set log_path=C:\EFS_Find

:: Find Encrypted Files
cipher /s C:\ | findstr "^.E" >> %log_path%\found.txt && echo:Encrypted files found"

:: Find Hidden Files
attrib /s C:\ 2>nul | findstr "^....H" >> %log_path%\found.txt && echo:Hidden files found"  

pause

This batch file will scan your C:\ drive for all EFS encrypted files (and also hidden files), echo on the screen every time it finds one, and record all instances of encrypted files found into C:\EFS_Find\found.txt.

For a command-line approach to finding just encrypted files, you can type in the command-line :

cipher /s:C:\ | findstr "^.E" >> C:\efs_found.txt && echo:Encrypted files found"

This will search your entire C:\ drive for encrypted files, and dump it into C:\efs_found.txt.

Modified from the solution found here.

To disable EFS on your Vista system, I refer you to the link here :

How to Disable or Enabled EFS Encryption in Vista

Windows – Vulnerability of EFS (Encrypting File System) on Windows 7

EFS is designed to protect your files based on your password. Therefore if your password is long and complex enough and of course it is only used for login it should be safe.

But usually Windows user passwords are much too short. Unfortunately Windows 7 stores them in special hashed way (NTLMv2) - older versions even in the more unsecure NTLM version. Using current graphic cards as code cracker even NTLMv2 password can broken:

Cracking NTLMv2 Authentication (from 2002) The interesting part is the second last slide even if it only considers old CPUs for breaking the password.

AFAIK only a complex password with 12 or more characters can be considered secure at the moment.

Best Answer

Related Solutions

Windows Vista EFS – Find Out What’s Encrypted

Windows – Vulnerability of EFS (Encrypting File System) on Windows 7

Related Question