One of the programs I used, apparently, set up file encryption on my PC. First, I noticed the "Encrypting File System" pop up asking to backup encryption certificate and key, then once I started looking why it would pop up in the first place, I found a certificate present in the user certificate storage with the purpose specified as "Encrypting file system" and "Valid From" a few minutes ago.
cipher /u /n gave me a list of encrypted files, which allowed me to (hopefully) identify the responsible program and remove it, unfortunately, for some reason it enabled encryption on whole bunch of files that are not related to that program and have paths that start with
C:\Program Files\WindowsApps and
%USERPROFILE%\AppData\Local\Packages (Windows Store apps, I presume).
I have access to the files, can see their contents, but for some reason I can't seem to remove encryption from them:
C:\Users\username\AppData\Local\Packages\Microsoft.FlightSimulator_xxxxxxxxxxxxx\Settings>cipher /d settings.dat Decrypting files in C:\Users\username\AppData\Local\Packages\Microsoft.FlightSimulator_xxxxxxxxxxxxx\Settings\ settings.dat [ERR] settings.dat: The parameter is incorrect. 0 file(s) [or directorie(s)] within 1 directorie(s) were decrypted.
It fails if I run it as Administrator, and even if I run it as SYSTEM with PsExec. Any idea how to decrypt those so I could safely remove the encryption certificate?
Update 1: The "Encrypt contents" checkbox is not set on a folder:
It is set on individual files, but trying to remove it produces the same error as
cipher /d produced:
I am the owner of the files: