I have noticed that all of my web application files turned green color, which means they are encrypted. I have never applied encryption to these files.

When I right-click the file, then go to Properties->General->Advanced and un-tick encryption and then click OK and Apply, I get the following error:

Error Applying Attributes
An error occurred applying attributes to the file:


Access is denied

When I right click again on the file and go to Properties->General->Advanced->Details it says that file is encrypted by me with certificate. Checked the certificate and it is ok.

After hours spent on forums here is what I tried without any success (still cannot delete/copy/edit files):

  • Got full control for encrypted folder and files
  • Got ownership of the encrypted folder and files
  • Got ownership of the System Volume Information folder
  • Tried removing and adding same certificate under Properties->General->Advanced->Details
  • Tried turning UAC off
  • Ran full system scan for malware and viruses

This is a production system, so I cannot keep restarting it to try different things. Any help would be appreciated

5 Answers 5


Download pstools from Microsoft website.. Here is the link https://technet.microsoft.com/en-us/sysinternals/pstools.aspx

Then extract it to c:\Pstools

  1. Open command prompt as administrator
  2. Go to directory c:\Pstools
  3. Run Psexec –i –s cmd.exe
  4. Make sure new command prompt windows is launched and running under system account by typing “whoami” on new cmd window

Decrypt files using CIPHER command

  1. Assuming we have this issue on F drive, change the default directory on command prompt(running under system account) to F:\
  2. Run the command CIPHER /d /a /I /s:”directory name”
  3. We need to run this command against all the directories under volume F one by one

You didn't say if other files on that volume are encrypted as well. Since BITLocker is enabled for the whole volume, I am assuming it's the case. Therefore:

Before you start

You must be logged on as an administrator.

The volume must be encrypted.

To turn off BitLocker Drive Encryption

Click Start, click Control Panel, click Security, and then click BitLocker Drive Encryption.

From the BitLocker Drive Encryption page, find the volume on which you want BitLocker Drive Encryption turned off, and click Turn Off BitLocker Drive Encryption.

From the What level of decryption do you want dialog box, click either Disable BitLocker Drive Encryption or Decrypt the volume as needed.

By completing this procedure, you have either disabled BitLocker or decrypted the operating system volume.

More info: Disable Encryption via BitLocker

  • Not all of the files are encrypted, only about 80%, the ones I have uploaded about 6 months ago
    – fenix2222
    Feb 7, 2013 at 2:45
  • OK, please go ahead and try the above - if there is an error msg saying there is no encryption enabled it would mean it got encrypted via either the web app or some other 3rd aprty app - we will shift the focus at that moment to finding the source of the encryption
    – TomEus
    Feb 7, 2013 at 4:24
  • I cannot see BitLocker Drive Encryption, all I have here is Windows Firewall, Windows Update and Internet Options. By the way only some files under C:\inetpub are encrypted, all other files are ok
    – fenix2222
    Feb 7, 2013 at 5:18
  • I typed BitLocker in Start -> Search and it doesn't come up. I don't think it is installed on our Win2008R2
    – fenix2222
    Feb 7, 2013 at 7:02
  • @Ramhound - I cannot see it. Where do I find it?
    – fenix2222
    Feb 7, 2013 at 22:08

"Error Applying Attributes" normally means that you are not the original user.
If you have recreated your user account in the last 6 months, then these files are lost.
More information about your certificate will be useful.

You might also have a look at this article, although I am not sure that it will be helpful and the described application costs $300 and is somewhat painful to use :
Legitimate app breaks popular encryption systems.

A trial version seems to be available.

  • That didn't work
    – fenix2222
    Feb 13, 2013 at 1:15
  • Please give some more details about : Where did these encrypted files come from, why are they encrypted, were they originally encrypted on this computer and under this same user account, were there any changes to this user account over the last 6 months.
    – harrymc
    Feb 13, 2013 at 8:39
  • The problem is that I don't know why it got encrypted. Files we copied from my computer to the server 6 months ago and only recently I noticed they are green. It says it is encrypted with certificate of the user I am logging in as and this has never changed. It is very weird. I was under impression that even if it gets encrypted I can recover it. I have left it for now as I have a copy of all the data, but the problem is that I can't even delete this stupid folder.
    – fenix2222
    Feb 13, 2013 at 22:12
  • If the files were encrypted on another computer, they can only be decrypted on that computer. The Microsoft encryption is regarded as unbreakable (except maybe for the CIA). The application I cited above is useless, since the right certificate is not on the computer.
    – harrymc
    Feb 14, 2013 at 6:45
  • ...It is also possible to copy certificates between computers.
    – harrymc
    Feb 14, 2013 at 6:52

If you right click the file(s), go to properties, click advanced, next to "encrypt contents to secure data" you'll see a details button. When you click on it, you get a window with the a list of users who can access the file(s).

Logging as a user in that list, you can remove the checkbox to encrypt the file.

If you have lots of them for the same user, you can run a script that goes like this in command prompt/powershell.

cipher /D "\\path\to\file1.ext"
cipher /D "\\path\to\file2.ext"
cipher /D "\\path\to\dir1\"
cipher /D "\\path\to\dir2\"
  • The author describe the user they were using had full permissions to the files in question. The problem was the author was unable to change the attribute of the files despite having permissions to do so. I am not sure I understand how this answers the question proposed by the author. Could you provide some clarification?
    – Ramhound
    Jan 16, 2015 at 18:50
  • Even having full NTFS permissions on the file, the user may be unable to decrypt a file if he's not in the list mentioned in my answer.
    – Julien B.
    Jan 16, 2015 at 19:25

Make sure the read-only attribute isn't selected. Seems obvious but people miss this pretty often.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .