# Cannot remove encryption from files on Windows 2008 R2

I have noticed that all of my web application files turned green color, which means they are encrypted. I have never applied encryption to these files.

When I right-click the file, then go to Properties->General->Advanced and un-tick encryption and then click OK and Apply, I get the following error:

Error Applying Attributes
An error occurred applying attributes to the file:

Path:\Filename

Access is denied


When I right click again on the file and go to Properties->General->Advanced->Details it says that file is encrypted by me with certificate. Checked the certificate and it is ok.

After hours spent on forums here is what I tried without any success (still cannot delete/copy/edit files):

• Got full control for encrypted folder and files
• Got ownership of the encrypted folder and files
• Got ownership of the System Volume Information folder
• Tried turning UAC off
• Ran full system scan for malware and viruses

This is a production system, so I cannot keep restarting it to try different things. Any help would be appreciated

-

You didn't say if other files on that volume are encrypted as well. Since BITLocker is enabled for the whole volume, I am assuming it's the case. Therefore:

Before you start

You must be logged on as an administrator.

The volume must be encrypted.


To turn off BitLocker Drive Encryption

Click Start, click Control Panel, click Security, and then click BitLocker Drive Encryption.

From the BitLocker Drive Encryption page, find the volume on which you want BitLocker Drive Encryption turned off, and click Turn Off BitLocker Drive Encryption.

From the What level of decryption do you want dialog box, click either Disable BitLocker Drive Encryption or Decrypt the volume as needed.

By completing this procedure, you have either disabled BitLocker or decrypted the operating system volume.


-
Not all of the files are encrypted, only about 80%, the ones I have uploaded about 6 months ago –  fenix2222 Feb 7 '13 at 2:45
OK, please go ahead and try the above - if there is an error msg saying there is no encryption enabled it would mean it got encrypted via either the web app or some other 3rd aprty app - we will shift the focus at that moment to finding the source of the encryption –  TomEus Feb 7 '13 at 4:24
I cannot see BitLocker Drive Encryption, all I have here is Windows Firewall, Windows Update and Internet Options. By the way only some files under C:\inetpub are encrypted, all other files are ok –  fenix2222 Feb 7 '13 at 5:18
I typed BitLocker in Start -> Search and it doesn't come up. I don't think it is installed on our Win2008R2 –  fenix2222 Feb 7 '13 at 7:02
@Ramhound - I cannot see it. Where do I find it? –  fenix2222 Feb 7 '13 at 22:08

"Error Applying Attributes" normally means that you are not the original user.
If you have recreated your user account in the last 6 months, then these files are lost.

You might also have a look at this article, although I am not sure that it will be helpful and the described application costs \$300 and is somewhat painful to use :
Legitimate app breaks popular encryption systems.

A trial version seems to be available.

-
That didn't work –  fenix2222 Feb 13 '13 at 1:15
Please give some more details about : Where did these encrypted files come from, why are they encrypted, were they originally encrypted on this computer and under this same user account, were there any changes to this user account over the last 6 months. –  harrymc Feb 13 '13 at 8:39
The problem is that I don't know why it got encrypted. Files we copied from my computer to the server 6 months ago and only recently I noticed they are green. It says it is encrypted with certificate of the user I am logging in as and this has never changed. It is very weird. I was under impression that even if it gets encrypted I can recover it. I have left it for now as I have a copy of all the data, but the problem is that I can't even delete this stupid folder. –  fenix2222 Feb 13 '13 at 22:12
If the files were encrypted on another computer, they can only be decrypted on that computer. The Microsoft encryption is regarded as unbreakable (except maybe for the CIA). The application I cited above is useless, since the right certificate is not on the computer. –  harrymc Feb 14 '13 at 6:45
...It is also possible to copy certificates between computers. –  harrymc Feb 14 '13 at 6:52

If you right click the file(s), go to properties, click advanced, next to "encrypt contents to secure data" you'll see a details button. When you click on it, you get a window with the a list of users who can access the file(s).

Logging as a user in that list, you can remove the checkbox to encrypt the file.

If you have lots of them for the same user, you can run a script that goes like this in command prompt/powershell.

cipher /D "\\path\to\file1.ext"
cipher /D "\\path\to\file2.ext"
cipher /D "\\path\to\dir1\"
cipher /D "\\path\to\dir2\"

-
The author describe the user they were using had full permissions to the files in question. The problem was the author was unable to change the attribute of the files despite having permissions to do so. I am not sure I understand how this answers the question proposed by the author. Could you provide some clarification? –  Ramhound Jan 16 at 18:50
Even having full NTFS permissions on the file, the user may be unable to decrypt a file if he's not in the list mentioned in my answer. –  Julien B. Jan 16 at 19:25