Encrypting File System protects a folder against another account on the same PC and against someone who pulls the drive. Without the certificate export, a reinstall makes the data unreadable forever.
Encrypt with **cipher /e /s:D:\vault**, then export the certificate with **Export-PfxCertificate** before you store anything important. The key, not the password, is what decrypts the files.
EFS is not available on Home editions, and it needs NTFS. **Get-Volume** shows the file system, and the edition string decides whether the cipher commands will do anything.
Get-Volume -DriveLetter D | Select-Object DriveLetter,FileSystem,FileSystemType
(Get-ComputerInfo).WindowsProductName
Get-WindowsEdition -Online | Select-Object Edition**cipher /e** sets the encrypted attribute, and **/s** applies it to the directory tree. New files created inside an encrypted folder inherit the attribute automatically.
New-Item -ItemType Directory D:\vault -Force | Out-Null
cipher /e /s:D:\vault
Get-ChildItem D:\vault | Select-Object Name,Attributes
(cipher /s:D:\vault) | Select-Object -First 5The protection is per user certificate, not per machine. A second local account that is not a recovery agent sees access denied, which is the actual test of the setup.
cipher /c D:\vault\secret.txt
Get-ChildItem D:\vault | Select-Object Name,Length,LastWriteTime
whoami /user**Export-PfxCertificate** writes both parts into one protected file. Store it off the machine: a key on the encrypted volume is worth nothing when the volume is gone.
$c = Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.EnhancedKeyUsageList.ObjectId -contains '1.3.6.1.4.1.311.10.3.4' } | Select-Object -First 1
$c | Select-Object Subject,Thumbprint,NotAfter
$pw = Read-Host -AsSecureString 'PFX password'
Export-PfxCertificate -Cert $c -FilePath E:\backup\efs-$env:COMPUTERNAME.pfx -Password $pw**Import-PfxCertificate** puts the key back into the personal store, and the files open again after a sign-in. The same password you set at export is required.
$pw = Read-Host -AsSecureString 'PFX password'
Import-PfxCertificate -FilePath E:\backup\efs-PC01.pfx -CertStoreLocation Cert:\CurrentUser\My -Password $pw
Get-ChildItem Cert:\CurrentUser\My | Select-Object Subject,Thumbprint,HasPrivateKey
cipher /c D:\vault\secret.txt**cipher /d** removes the attribute from the tree. Files stay readable by any account with NTFS permissions afterwards, which is exactly why the export belongs in a safe place until the data is gone.
cipher /d /s:D:\vault
Get-ChildItem D:\vault | Select-Object Name,Attributes
Remove-Item Cert:\CurrentUser\My\<thumbprint> -ForceThe volume is exFAT, FAT32 or a network share. EFS needs a local NTFS volume; move the folder or reformat, and keep a backup first.
The folder only shows the attribute for new files. Encrypt the existing tree with cipher /e /s, and check the attribute column instead of the colour.
That account is an EFS recovery agent or an administrator with the key. Check cipher /c for the listed users and remove the recovery agent in a local policy.
The private key is marked as non-exportable. Try certmgr.msc with the Export wizard; if the key was created as non-exportable, it cannot be backed up.
No. Compression shrinks the data and saves space; EFS protects the content with a key. Both set an attribute on the folder, and both can be on at the same time.
Only if the stick is formatted NTFS. On exFAT the command fails, so use a container file on an NTFS volume instead.
The PFX password is what you set, not your Windows password. Keep it with the file, or the export cannot be imported.
Run cipher /d /s:D:\vault to decrypt the tree, then delete the exported PFX and the certificate from Cert:\CurrentUser\My once the data is confirmed readable.
Free · no account needed · tracks your progress