What is EFS?
EFS is built into NTFS. Instead of encrypting a whole drive, it encrypts only the files and folders you choose, and access follows the Windows user account that encrypted them. That user opens the files normally. Another user signed in to the same PC gets "Access denied," even when NTFS permissions would otherwise allow access.
How EFS works
- Windows generates a random symmetric key, the file encryption key (FEK), and encrypts the file's contents with it.
- The FEK is encrypted with the public key from the user's EFS certificate and stored with the file.
- To open the file, Windows uses the user's private key to unlock the FEK. If a data recovery agent (DRA) is configured, the FEK is also encrypted for the DRA so the organization can recover the file.
The private key lives in the user's profile and is protected by the account's credentials, so losing the profile or certificate can mean losing the files.
Using EFS
- GUI: right-click the file or folder, choose Properties, then Advanced, and check Encrypt contents to secure data. Encrypted items show a padlock overlay in File Explorer.
- Command line:
cipher /eencrypts,cipher /ddecrypts, andcipherwith no switches shows the encryption state of the current folder.cipher /xbacks up the EFS certificate and keys to a file. - Folders: new files created in an encrypted folder are encrypted automatically.
- Compression: NTFS compression and EFS can't be applied to the same file. In the Advanced Attributes dialog, checking one clears the other.
Rules and gotchas
- Edition: Windows Home editions can't encrypt files with EFS; the checkbox is unavailable. Pro, Enterprise and Education support it.
- Copying off NTFS: copying an encrypted file to a FAT32 or exFAT volume, such as many USB flash drives, removes the encryption. Windows warns before it does this.
- Back up the certificate: export the EFS certificate with its private key to a password-protected
.pfxfile, using the backup prompt Windows shows,certmgr.msc(Personal > Certificates) orcipher /x. Without that backup or a recovery agent, an OS reinstall or deleted profile leaves the files unreadable. - Password resets: when an administrator resets a local account's password, instead of the user changing it, the user can lose access to EFS-encrypted files. Windows warns about this in the reset dialog.
EFS vs. BitLocker
| Feature | EFS | BitLocker |
|---|---|---|
| Scope | Individual files and folders | Entire volume |
| Tied to | A user account's certificate | The drive, unlocked with a TPM, PIN, password or recovery key |
| Protects against | Other users of the same running PC | Offline access to a lost or stolen drive |
| Recovery | Exported certificate or data recovery agent | 48-digit recovery key |
They can be combined: BitLocker protects the whole disk at rest, and EFS keeps one user's files private from other people who can sign in to the same computer.
EFS on the CompTIA A+ exam
EFS is on the A+ acronym list and is Core 2 subject matter (Windows security features and NTFS). Expect scenario cues like these:
- Protect one user's folder from other users of the same PC: EFS. Protect a whole laptop drive in case it's stolen: BitLocker.
- The encryption option is grayed out: the PC is running a Home edition.
- A file lost its encryption after being copied to a flash drive: the destination was FAT32 or exFAT.
- Files are unreadable after a reinstall or profile rebuild: restore the backed-up EFS certificate or use the recovery agent.