You may have an expired EFS Data Recovery Agent certificate for your domain.

Test if this is the case by using this procedure:

• save a text file on your workstation (c:\temp\myfile.txt for example)
• edit its properties and encrypt the file

If the recovery agent isn't valid you won't be able to encrypt the file and you will receive an error indicating a problem with the recovery agent.

To resolve this issue replace the expired certificate and update Group Policy on the impacted workstations.

From the Microsoft Directory Services Team Blog:

Find the certificate

• On the server, locate and open the Default Domain Policy navigate to Computer Configuration -> Windows Settings -> Public Key Policies -> Encrypting File System

• In the right-hand pane, right-click on the expired certificate and select All Tasks | Export

Create a new certificate

• From a workstation, run the command cipher /r:<filename-without-extension> and use any password you wish when prompted
• Copy the resulting .CER and .PFX files to your server

Import the certificate and refresh Group Policy

• Return to the server, re-locate the Default Domain Policy, highlight Encrypting File System, and select Add Data Recovery Agent
• Browse for the .CER and .PFX files you just copied over and answer YES if you are warned about revocation or prompted to the install the certificate.
• Add the certificate to the Domain Trusted Root store (Computer Configuration -> Windows Settings -> Public Key Policies -> Trusted Root Certificate Authorities)
• Force an update of group policy using gpupdate /force at a command prompt

Confirm your existing files have been updated with the new DRA certificate

• check the Advanced Attributes of an encrypted file and compare the thumbprint of the DRA to the thumbprint of the certificate you just created.

Completely disable Offline Files

By default, the Sync Center won't start automatically unless you first establish a sync partnership (e.g. you make some network file or folder available offline). The icon will still be available in the notification area even after reverting back the changes.

Disabling the Offline Files features should prevent the Sync Center from running at log on. In case it doesn't, follow the steps below in their exact order.

Reset the sync cache and database

1. Make sure the Offline Files features is enabled and active.

2. Open an elevated command prompt.

3. Type or paste the following command, and press Enter:

   reg add "HKLM\System\CurrentControlSet\Services\CSC\Parameters" /v FormatDatabase /t REG_DWORD /d 1 /f
   

4. Restart Windows.

Disable driver and service

1. Open an elevated command prompt.

2. Run the following command:

   for %G in ("CSC","CscService") do sc config "%~G" start= disabled
   

3. Restart Windows to apply the changes.

Clear the Client-Side Cache (CSC)

At this point the offline cache should be empty. By running the commands below in an elevated command prompt you can ensure there are no leftovers:

takeown /f "%windir%\CSC" /a /r
icacls "%windir%\CSC" /grant:r *S-1-5-32-544:F /t /c /q
icacls "%windir%\CSC" /grant:r *S-1-5-18:F /t /c /q
for /d %G in ("%windir%\CSC\v2.0.6\namespace\*") do rd /s /q "%~G"

Note The Offline Files driver and service must be stopped for the commands to work.

Disable scheduled tasks

Open an elevated command prompt, and run the following commands:

schtasks /change /tn "\Microsoft\Windows\Offline Files\Background Synchronization" /disable
schtasks /change /tn "\Microsoft\Windows\Offline Files\Logon Synchronization" /disable

Prevent the Sync Center from starting at log on

1. Open a command prompt.

2. Type or paste the following commands, pressing Enter each time:

   reg add "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\SyncMgr" /v "StartAtLogin" /t REG_DWORD /d 0 /f
   reg add "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\SyncMgr\HandlerInstances\{750FDF10-2A26-11D1-A3EA-080036587F03}" /v "Active" /t REG_DWORD /d 0 /f
   reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\SyncMgr" /f
   reg delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\NetCache" /f
   reg delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\SyncMgr\HandlerInstances\{750FDF10-2A26-11D1-A3EA-080036587F03}\SyncItems" /f
   

3. Log off and log back on.

Note The changes won't stick if at least one sync partnership is set up and the Offline Files service is running.

References

• On a Windows Vista-based or Windows 7-based client computer, you can still access offline files even though the file server is removed from the network
• Can't remove Sync Partnership
• Disable Sync Center from Auto Starting