Windows Vista - Wednesday, January 2, 2008 4:30 - 0 Comments

Disabling File and Folder Encryption

On Windows Vista and later, you can prevent users from encrypting their files in two ways. First, by running the command fsutil behavior set disableencryption 1 you can disable EFS on all NTFS volumes on your machine, so by deploying this command using a logon script you can disable EFS on targeted users’ computers.

And second, since all the above fsutil command does is to modify NtfsDisableEncryption, a REG_DWORD value found under HKLMSYSTEMCurrentControlSetControlFileSystem, this means that you could also create a custom ADMX file to deploy this registry modification using Group Policy. For more information on how to create a custom ADMX file, see KB 918239

Note that if either method is used, the registry modification doesn’t take effect until after a reboot. In addition, before you disable encryption you should decrypt any previously encrypted files and folders on the machine, otherwise you won’t be able to access them once encryption has been disabled.

Article written by MyComputerAid.com