Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm experiencing strange behavior with Windows Encrypted File System:

  1. I have a machine that is in workgroup mode (not joined to a domain)
  2. I encrypt an entire directory structure on the machine (basically a folder and subfolders with data files for my application).
  3. My application writes and reads files from the encrypted file hierarchy as a local Windows user (let's call the account 'SecureUser'). This works fine
  4. I then join the PC to a domain (Let's call it 'TEST')
  5. Afterwards, processes running as the local 'SecureUser' account can't read the files it wrote originally when it was off the domain (What is also strange is that the files are listed as "read only" now and I cannot unset this flag via Windows Explorer or the command line, even though it looks like it succeeds)
  6. I then 'un-join' the PC from the domain and everything works again

Is there something about changing domain membership on a PC that changes the behavior of EFS so that previously encrypted files cannot be read, even by the originating user?

Thanks in advance

share|improve this question

Are you sure the process is running as LOCAL\SecureUser and not a DOMAIN\SecureUser by the same name?

Also, do you have any group policies regarding EFS and/or local user accounts that might be getting applied when the machine is on the domain? Such policies would cease to apply once you pulled it off the domain and that would explain why it works again.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.