How to Encrypt Folders Using EFS in Windows 11

The Encrypting File System (EFS) is a built-in Windows feature that allows you to encrypt individual files and folders on NTFS drives to protect sensitive data from unauthorized access. This guide walks you through the step-by-step process of enabling EFS encryption on specific folders in Windows 11, managing the encryption scope, and backing up your security certificate so you never lose access to your files.

Requirements

EFS is natively supported on Windows 11 Pro, Enterprise, and Education editions. It is not available on Windows 11 Home edition. Additionally, the drive containing the folder must be formatted using the NTFS file system.

Step-by-Step: Encrypting a Folder with EFS

  1. Locate the Folder: Open File Explorer and navigate to the folder you want to encrypt.
  2. Open Properties: Right-click the folder and select Properties from the context menu (or press Alt + Enter).
  3. Open Advanced Attributes: Under the General tab, click the Advanced… button in the Attributes section.
  4. Enable Encryption: In the Advanced Attributes window, check the box labeled Encrypt contents to secure data.
  5. Apply Settings: Click OK to close the Advanced Attributes window, then click Apply in the Properties window.
  6. Choose Encryption Scope: An Attribute Changes prompt will appear. Choose one of the following options:
    • Apply changes to this folder, subfolders and files (Recommended: ensures all current and future contents are encrypted).
    • Apply changes to this folder only.
  7. Finalize: Click OK to apply the encryption, then click OK to close the folder properties.

Once encrypted, Windows displays a small padlock icon over the folder icon to indicate that EFS protection is active.

Backing Up Your EFS Encryption Certificate

It is critical to back up your encryption certificate. If your Windows user profile becomes corrupted or you reinstall the operating system, you will permanently lose access to your encrypted data without this key.

  1. When you encrypt a folder for the first time, Windows displays a notification in the system tray prompting you to back up your encryption key. Click this notification.
  2. If the notification does not appear, press Win + R, type certmgr.msc, and press Enter to open the Certificate Manager.
  3. Expand Personal > Certificates.
  4. Right-click your EFS certificate (listed with “Encrypting File System” under Intended Purposes), select All Tasks, and click Export.
  5. Follow the Certificate Export Wizard:
    • Select Yes, export the private key.
    • Leave the export file format as Personal Information Exchange - PKCS #12 (.PFX).
    • Set a strong password to protect the exported file.
    • Choose a save location on an external drive or secure cloud storage.
  6. Click Finish to complete the backup.

How to Remove EFS Encryption

If you no longer need the folder to be encrypted:

  1. Right-click the encrypted folder and select Properties.
  2. Click Advanced… under the General tab.
  3. Uncheck Encrypt contents to secure data.
  4. Click OK, then click Apply.
  5. Choose whether to apply changes to subfolders and files, then click OK.