How to fix Error 431 on Windows 11

by

Troubleshooting Guide: Error 431 – “This Encryption Operation Cannot Be Performed on Filesystem Metadata”

Why This Error Happens

This error occurs when the Encrypting File System (EFS) attempts to apply encryption attributes to a file or folder that is classified as filesystem metadata, such as system files, the root directory, or reparse points, which Windows explicitly protects from EFS operations. It commonly arises when a user or script tries to encrypt an entire drive volume, a system-protected folder, or files with special attributes (like junction points) rather than standard user data. Corrupted NTFS metadata structures or attempting encryption via cipher.exe on restricted paths can also trigger this specific error code.

Step-by-Step Resolution Guide

  1. Identify the exact file/folder path: Open Command Prompt as Administrator and run cipher /c "C:\path\to\file" to see which specific item is causing the failure.

  2. Avoid encrypting protected system locations: Do not attempt to encrypt the root of a drive (e.g., C:\), the Windows folder, Program Files, or hidden system folders. Move the target file to a standard user directory like C:\Users\YourUsername\Documents and encrypt it there instead.

  3. Check and repair NTFS integrity: Run chkdsk C: /f /r from an elevated Command Prompt (a restart will be required) to scan and repair underlying filesystem metadata corruption that may be triggering the false-positive error.

  4. Remove conflicting file attributes: Right-click the file/folder → Properties → Advanced, and ensure “Encrypt contents to secure data” isn’t being applied alongside compression or a reparse point (like a symbolic link). Run attrib -r -s -h "C:\path\to\file" to strip restrictive attributes before retrying encryption.

  5. Update Group Policy EFS settings: Open gpedit.msc → Computer Configuration → Windows Settings → Security Settings → Public Key Policies → Encrypting File System, and confirm EFS is enabled and not restricted by policy for the target volume.

Alternative or Verification Steps

  • Verify the fix: After moving the file and re-running encryption, confirm success by checking file properties (Advanced → “Encrypt contents to secure data” should show as checked and the filename should appear green in File Explorer).
  • Alternative solution: If EFS continues to fail on a specific volume, use BitLocker Drive Encryption instead (Control Panel > BitLocker Drive Encryption), as it encrypts at the volume level and is not subject to the same file/metadata restrictions as EFS.