Cannot remove encryption from files on Windows 2008 R2

Question

I have noticed that all of my web application files turned green color, which means they are encrypted. I have never applied encryption to these files.

When I right-click the file, then go to Properties->General->Advanced and un-tick encryption and then click OK and Apply, I get the following error:

Error Applying Attributes
An error occurred applying attributes to the file:

Path:\Filename

Access is denied

When I right click again on the file and go to Properties->General->Advanced->Details it says that file is encrypted by me with certificate. Checked the certificate and it is ok.

After hours spent on forums here is what I tried without any success (still cannot delete/copy/edit files):

• Got full control for encrypted folder and files
• Got ownership of the encrypted folder and files
• Got ownership of the System Volume Information folder
• Tried removing and adding same certificate under Properties->General->Advanced->Details
• Tried turning UAC off
• Ran full system scan for malware and viruses

This is a production system, so I cannot keep restarting it to try different things. Any help would be appreciated

Solution 1

Download pstools from Microsoft website.. Here is the link https://technet.microsoft.com/en-us/sysinternals/pstools.aspx

Then extract it to c:\Pstools

1. Open command prompt as administrator
2. Go to directory c:\Pstools
3. Run Psexec –i –s cmd.exe
4. Make sure new command prompt windows is launched and running under system account by typing “whoami” on new cmd window

Decrypt files using CIPHER command

1. Assuming we have this issue on F drive, change the default directory on command prompt(running under system account) to F:\
2. Run the command CIPHER /d /a /I /s:”directory name”
3. We need to run this command against all the directories under volume F one by one

Solution 2

You didn't say if other files on that volume are encrypted as well. Since BITLocker is enabled for the whole volume, I am assuming it's the case. Therefore:

Before you start

You must be logged on as an administrator.

The volume must be encrypted.

To turn off BitLocker Drive Encryption

Click Start, click Control Panel, click Security, and then click BitLocker Drive Encryption.

From the BitLocker Drive Encryption page, find the volume on which you want BitLocker Drive Encryption turned off, and click Turn Off BitLocker Drive Encryption.

From the What level of decryption do you want dialog box, click either Disable BitLocker Drive Encryption or Decrypt the volume as needed.

By completing this procedure, you have either disabled BitLocker or decrypted the operating system volume.

More info: Disable Encryption via BitLocker

Comments

[fenix2222]

Not all of the files are encrypted, only about 80%, the ones I have uploaded about 6 months ago

[TomEus]

OK, please go ahead and try the above - if there is an error msg saying there is no encryption enabled it would mean it got encrypted via either the web app or some other 3rd aprty app - we will shift the focus at that moment to finding the source of the encryption

[fenix2222]

I cannot see BitLocker Drive Encryption, all I have here is Windows Firewall, Windows Update and Internet Options. By the way only some files under C:\inetpub are encrypted, all other files are ok

[fenix2222]

I typed BitLocker in Start -> Search and it doesn't come up. I don't think it is installed on our Win2008R2

[fenix2222]

@Ramhound - I cannot see it. Where do I find it?

[fenix2222]

That didn't work

[harrymc]

Please give some more details about : Where did these encrypted files come from, why are they encrypted, were they originally encrypted on this computer and under this same user account, were there any changes to this user account over the last 6 months.

[fenix2222]

The problem is that I don't know why it got encrypted. Files we copied from my computer to the server 6 months ago and only recently I noticed they are green. It says it is encrypted with certificate of the user I am logging in as and this has never changed. It is very weird. I was under impression that even if it gets encrypted I can recover it. I have left it for now as I have a copy of all the data, but the problem is that I can't even delete this stupid folder.

[harrymc]

If the files were encrypted on another computer, they can only be decrypted on that computer. The Microsoft encryption is regarded as unbreakable (except maybe for the CIA). The application I cited above is useless, since the right certificate is not on the computer.

[harrymc]

...It is also possible to copy certificates between computers.

[fenix2222]

I will try it, I doubt I can find the right certificate. Thanks for your time, I will award 100 points

[Ramhound]

The author describe the user they were using had full permissions to the files in question. The problem was the author was unable to change the attribute of the files despite having permissions to do so. I am not sure I understand how this answers the question proposed by the author. Could you provide some clarification?