Cannot remove encryption from files on Windows 2008 R2

Question

I have noticed that all of my web application files turned green color, which means they are encrypted. I have never applied encryption to these files.

When I right-click the file, then go to Properties->General->Advanced and un-tick encryption and then click OK and Apply, I get the following error:

Error Applying Attributes
An error occurred applying attributes to the file:

Path:\Filename

Access is denied

When I right click again on the file and go to Properties->General->Advanced->Details it says that file is encrypted by me with certificate. Checked the certificate and it is ok.

After hours spent on forums here is what I tried without any success (still cannot delete/copy/edit files):

• Got full control for encrypted folder and files
• Got ownership of the encrypted folder and files
• Got ownership of the System Volume Information folder
• Tried removing and adding same certificate under Properties->General->Advanced->Details
• Tried turning UAC off
• Ran full system scan for malware and viruses

This is a production system, so I cannot keep restarting it to try different things. Any help would be appreciated

Answer 1

Download pstools from Microsoft website.. Here is the link https://technet.microsoft.com/en-us/sysinternals/pstools.aspx

Then extract it to c:\Pstools

1. Open command prompt as administrator
2. Go to directory c:\Pstools
3. Run Psexec –i –s cmd.exe
4. Make sure new command prompt windows is launched and running under system account by typing “whoami” on new cmd window

Decrypt files using CIPHER command

1. Assuming we have this issue on F drive, change the default directory on command prompt(running under system account) to F:\
2. Run the command CIPHER /d /a /I /s:”directory name”
3. We need to run this command against all the directories under volume F one by one

Answer 2

You didn't say if other files on that volume are encrypted as well. Since BITLocker is enabled for the whole volume, I am assuming it's the case. Therefore:

Before you start

You must be logged on as an administrator.

The volume must be encrypted.

To turn off BitLocker Drive Encryption

Click Start, click Control Panel, click Security, and then click BitLocker Drive Encryption.

From the BitLocker Drive Encryption page, find the volume on which you want BitLocker Drive Encryption turned off, and click Turn Off BitLocker Drive Encryption.

From the What level of decryption do you want dialog box, click either Disable BitLocker Drive Encryption or Decrypt the volume as needed.

By completing this procedure, you have either disabled BitLocker or decrypted the operating system volume.

More info: Disable Encryption via BitLocker

Answer 3

"Error Applying Attributes" normally means that you are not the original user.
If you have recreated your user account in the last 6 months, then these files are lost.
More information about your certificate will be useful.

You might also have a look at this article, although I am not sure that it will be helpful and the described application costs $300 and is somewhat painful to use :
Legitimate app breaks popular encryption systems.

A trial version seems to be available.

Answer 4

If you right click the file(s), go to properties, click advanced, next to "encrypt contents to secure data" you'll see a details button. When you click on it, you get a window with the a list of users who can access the file(s).

Logging as a user in that list, you can remove the checkbox to encrypt the file.

If you have lots of them for the same user, you can run a script that goes like this in command prompt/powershell.

cipher /D "\\path\to\file1.ext"
cipher /D "\\path\to\file2.ext"
cipher /D "\\path\to\dir1\"
cipher /D "\\path\to\dir2\"

Answer 5

Make sure the read-only attribute isn't selected. Seems obvious but people miss this pretty often.