Windows 11 Error 406: Encrypted File Access Denied When Device Locked

Why This Error Happens

Error 406 occurs when an application attempts to read or write to a file protected by Windows’ device encryption (BitLocker) or Encrypting File System (EFS) while the device is in a locked state. This happens because certain encryption keys are only unsealed and made available to the Windows security subsystem after successful user authentication, meaning any background process or scheduled task trying to access the file before unlock will be denied. Corrupted certificate stores or an interrupted encryption process can also trigger this error even when the device appears to be unlocked.

Step-by-Step Resolution Guide

1. Unlock the Device and Retry: Ensure the PC is fully unlocked (not just on the login screen) and manually retry the read/write operation to confirm it isn’t a simple timing issue with a background sync tool.
2. Check Power & Sleep Settings: Go to Settings > System > Power & battery > Screen and sleep and ensure the device isn’t set to sleep or lock during active file transfers, as background tasks (like cloud backups) often trigger this error if the screen locks mid-transfer.
3. Verify EFS Certificate Validity: Open the Run dialog (Win + R), type certmgr.msc, and navigate to Personal > Certificates. Look for a valid “Encrypting File System” certificate. If it appears expired or corrupted, you will need to export a backup (if accessible) or contact your admin to reset the encryption certificate.
4. Adjust Group Policy for Encryption: Type gpedit.msc in the Run dialog and navigate to Computer Configuration > Administrative Templates > System > Removable Storage Access. Verify that encryption policies are not conflicting with the specific storage location of the file.
5. Repair the System File Checker (SFC): Open Command Prompt as Administrator and run sfc /scannow. This repairs corrupted system files that manage the encryption/decryption handshake between the OS and the storage drive.

Alternative or Verification Steps

• Verification: Attempt to copy the specific file to an unencrypted local folder (like a temporary desktop folder) while the device is unlocked. If the copy succeeds without Error 406, the encryption keys are functioning correctly.
• Alternative Fix: If the error persists on a specific file, right-click the folder containing the file, select Properties > Advanced, uncheck “Encrypt contents to secure data,” apply the changes, and then re-enable encryption to refresh the file’s specific encryption key.