Is this method exhaustive? That is, is there any chance it might miss any files?

I ask because I've gotten this notification on each boot for the past week:




That was surprising as I've not manually encrypted any files. I ran the command both ways, and no encrypted files were found. No external hard drives plugged in, either.



Is there another way to determine what's using the Encrypting File System?

Brink said:

Hello @ikjadoon,

I've seen others with the same issue and never encrypted anything with EFS. I'm thinking it may have been from some 3rd party program that may have encrypted some of its files.


Backing up the certificate and key will stop the notification.

Hello, @Brink!

Thank you for the excellent advice. I was just starting the back up (using option two here) and that exposed the issue! One certificate was for NVIDIA GameStream server (I have a GT 710 in this system), which looked weird.

I'd installed GeForce Experience for some time, but never used it for anything but a quick link to download & install drivers. Not a big loss, then, to uninstall it.

I uninstalled GeForce Experience, the certificate disappeared, and as of ~30 minutes after another reboot, I've not had the notification again.

Brink said:

Great news.

Absolutely. Thank you again. �� It's still working great a week later.

My son was playing with going into a file properties and encrypting the file on some files and we got the prompt to export the certificate. I did not do the export on the prompt but did manually after reading about EFS. On next boot I got the prompt and exported again.

If I run the command "cipher /u /n /h" in as regular command prompt does it make any changes or just lists the files? I am concerned on messing something up

The system also has bitlocker turned on if that has any impact on this.

thanks

Thanks. I just ran the command and no encrypted files were found. In command prompt it was under is user file name C:/Users/username>

So I am not sure if that searches outside of that.

Also, on the next reboot I was not prompted to export the key. However, if there are no files using EFS will it still ask for a key? Says he deleted the file after playing with it?