IT Guide: What Is Encrypting File System (EFS)?

The Encrypting File System (EFS) is a built-in Windows feature that encrypts individual files and folders on NTFS drives, making them unreadable to anyone without the correct account or encryption certificate. It’s available on Windows Pro, Enterprise, and Education editions, and it gives you file-level protection without encrypting an entire drive — which is where it differs from BitLocker.

What is EFS?

EFS is included in Windows Pro, Enterprise, and Education editions. It is not available in Windows Home — if you’re on Home and don’t see the “Encrypt contents to secure data” option, that’s why. Windows 11 Home instead offers Device Encryption, a simplified, BitLocker-based feature that can turn on automatically when you sign in with a Microsoft account on a device with TPM 2.0, though it protects the whole drive rather than individual files.

What is the purpose of EFS in Windows?

Microsoft introduced EFS to help users protect their data on NTFS (New Technology File System) drives. When you encrypt a file or folder using EFS, Windows converts it into an unreadable format that can only be accessed with the correct encryption key. The goal of the EFS is to prevent unauthorized access to data, especially in environments where multiple users share the same device.

How EFS differs from other encryption methods

While file encryption is common in data security, EFS works differently from traditional encryption methods. It’s designed specifically for files and folders on NTFS drives.

Other methods, such as BitLocker, focus on full-drive encryption. On Windows 11 Home, Device Encryption fills a similar full-drive role using BitLocker’s underlying technology, but without EFS’s file-level control.

Why EFS matters for data protection

Data protection is essential for both personal and business use. EFS encryption offers a convenient way to secure sensitive files without encrypting an entire drive, striking a balance between security and usability. This is especially useful when sharing a computer, working with confidential business documents, or storing personal information on a device that multiple users have access to.

How EFS encryption works

Understanding how EFS encryption works can help you make the most of this security feature. EFS encryption relies on encryption keys and user permissions to protect files.

Overview of the EFS encryption process

The process starts when you select a file or folder to encrypt. Windows generates a unique encryption key, known as the File Encryption Key (FEK), which scrambles the file’s data into an unreadable format. Only the user who encrypted the file can decrypt it.

How Windows uses encryption keys for EFS

Encryption keys are central to EFS encryption. When you encrypt a file with EFS, Windows generates an FEK, which is protected by a user-specific encryption certificate. This certificate is securely stored in your account profile, enabling Windows to verify your identity and grant access to encrypted files.

The role of user accounts in EFS security

User accounts add another layer of security to the Encrypting File System. Encryption keys are tied to Windows accounts, preventing file access without the correct account credentials. This makes EFS encryption highly effective against unauthorized access.

Benefits and limitations of using EFS encryption

EFS encryption offers several advantages but also has limitations. Let’s take a closer look at both.

Advantages of EFS for personal and business use

EFS encryption provides several benefits for users who need to protect specific files:

• Selective encryption: You can choose to encrypt individual files or folders rather than encrypting the entire drive.
• Ease of use: EFS is simple to set up, making it accessible for most users.
• Integration with Windows security: As a native Windows feature, EFS works seamlessly with other built-in security measures.

Common limitations of EFS to consider

While EFS encryption is useful, it has some limitations:

• Limited to NTFS drives: EFS only works on NTFS-formatted drives; it’s not compatible with FAT32 or exFAT drives.
• No protection for offline transfers: If encrypted files are copied to a non-NTFS drive, they lose their encryption.
• User account dependency: Since EFS encryption is tied to the user account, it becomes inaccessible if the account is deleted or corrupted. A forced password reset on a local account by an administrator has the same effect: it breaks the key linkage and locks the user out of their own encrypted files, so a domain data recovery agent should be configured before relying on EFS.
• Limited protection from compromised accounts: Malicious users can gain access to files if they log in, since EFS does not protect files once a user is logged in.

Setting up EFS on your files and folders

Enabling EFS encryption on Windows is straightforward, and you can apply it to individual files or folders. Here’s how to get started.

Step-by-step guide to enabling EFS on Windows

1. Locate the file or folder you want to encrypt and right-click on it.
2. Select “Properties” from the context menu.
3. In the Properties window, go to the “General” tab and click on “Advanced.”
4. Check the box next to “Encrypt contents to secure data” and click “OK.”
5. Apply the changes, and Windows will encrypt the selected file or folder.

Encrypted files and folders turn green in File Explorer, so you can spot them at a glance. If you need to enable EFS system-wide first, manage it via Group Policy, PowerShell, or the cipher command.

Choosing which files and folders to encrypt

Not all files require encryption, so focus on those that contain sensitive information. Examples of files that benefit from file encryption include:

• Financial documents
• Personal identification files
• Confidential work files

Managing encrypted files across user accounts

If multiple users need access to encrypted files, you can grant them permission by adding their encryption certificates to the file. This allows multiple people to work with the encrypted content securely.

Best practices for managing EFS-encrypted files

To maintain a secure and accessible EFS setup, follow these best practices.

Back up EFS encryption keys securely

Encryption keys are essential for accessing EFS-encrypted files, so keeping a secure backup is critical. If the original key is lost, encrypted files become inaccessible. Windows offers a key export feature that lets you save a copy of your EFS encryption certificate to an external drive or cloud storage for safekeeping.

Tips for smooth access to encrypted files

For a smooth experience with EFS encryption, keep these tips in mind:

• Create backups of encrypted files to prevent data loss.
• Avoid renaming or moving encrypted files outside of NTFS drives, as this can remove encryption.
• Log in regularly to maintain access, especially if the encrypted files are tied to a specific Windows account.

Handling encrypted files when transferring or sharing

EFS-encrypted files lose their protection when transferred to non-NTFS formats, so handle them carefully when moving or sharing:

The same thing happens the moment you attach a file to an email or upload it to a browser. Windows decrypts it on the fly before it leaves the device, so EFS alone doesn’t protect data in transit.

• Use NTFS-formatted storage to transfer encrypted files and retain EFS encryption.
• Consider using secure methods, like cloud-sharing services with built-in encryption, to maintain file encryption when sharing.

EFS is a powerful Windows tool for file encryption that provides a reliable way to secure individual files and folders on NTFS drives. While EFS encryption offers significant benefits, it also has limitations, especially when sharing files across devices or using non-NTFS drives.

To further solidify your understanding of EFS operations, you may view this short visual walkthrough: ‘IT Guide: What Is Encrypting File System (EFS)?’.

Where NinjaOne fits

EFS is a Windows-native feature, but keeping track of encryption status across every device is harder at scale. The NinjaOne Windows Endpoint Management platform gives IT teams visibility into device configuration and security posture across their fleet, so encryption gaps don’t go unnoticed on a shared or multi-user machine. See what NinjaOne Windows Endpoint Management can do.

Start a NinjaOne free trial or watch a demo.