ERROR_EFS_SERVER_NOT_TRUSTED (0X0000177B) – Quick Fix Guide

1. Missing or Invalid EFS Certificate on the Server

This is the number one reason I see this error. The server you're trying to encrypt files on doesn't have a valid EFS certificate. EFS uses a self-signed certificate tied to the machine's account. If that certificate is missing, corrupted, or expired, Windows throws the 0x0000177B error.

Real scenario: Last month, a client had a file server running Windows Server 2019. They renamed the server after it was already in use. The EFS certificate is tied to the machine name. Rename broke the trust. Suddenly no one could encrypt files remotely. Exact same error code.

How to fix it

1. Log on to the server that's showing the error.
2. Open Certificates snap-in (run certlm.msc for local machine).
3. Navigate to Personal > Certificates.
4. Look for a certificate with "Encrypting File System" in the intended purposes. If it's missing, expired, or has a different name than the server, that's your problem.
5. If missing, you can force creation: run this command in PowerShell as admin:
   

   cipher /R:EFSRecovery

   This creates a recovery certificate and also triggers EFS to generate a new self-signed cert. Then reboot.
6. If cert exists but is expired, delete it and force a new one using the same cipher /R trick.

Quick test: After reboot, try encrypting a test file on the server locally. If it works, the server side is fixed. Now test remote encryption again.

2. Group Policy Blocks Remote EFS Trust

Even with a good certificate, the server might not be trusted because of group policy settings. There's a policy called "Network access: Do not allow storage of passwords and credentials for network authentication" that can break EFS completely. Also, there's a specific policy for EFS: "Encrypting File System (EFS) – Allow or deny use of EFS".

Real scenario: A small law firm had this error after their IT admin tightened security policies. He enabled "Do not allow storage of passwords" thinking it was about cached credentials. Broke EFS remote encryption on all servers.

How to check and fix

1. Open Group Policy Management Console (gpmc.msc).
2. Find the GPO applied to the server (or domain-wide).
3. Navigate to:
   

   Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options

4. Look for "Network access: Do not allow storage of passwords and credentials for network authentication". Set it to Disabled.
5. Also check Computer Configuration > Administrative Templates > System > EFS. Verify "Allow use of EFS" is set to Enabled or Not Configured.
6. Run gpupdate /force on the server.
7. Reboot to be safe.

3. Kerberos Ticket Issue – Delegation or SPN Problem

EFS relies on Kerberos for authentication between machines. If the server's Service Principal Name (SPN) is missing or duplicated, Kerberos won't trust the ticket. The error shows up as 0x0000177B but it's really a Kerberos failure underneath.

Real scenario: A developer set up a test server with the same name as the production server. Both had duplicate SPNs in Active Directory. Remote EFS failed on both. Took me two hours to find the duplicate.

How to fix it

1. On a domain controller or admin machine, run:
   

   setspn -Q */*servername*

   Replace servername with the actual server name. Look for duplicates. Any SPN showing more than once is bad.
2. If duplicates exist, remove the extra one using:
   

   setspn -D <spn> <computername>

3. Also check the server's computer account has the correct HOST and EFS SPNs. For a file server, you need:
   

   HOST/servername
   HOST/servername.domain.com

4. If SPNs look fine but the error persists, clear the Kerberos ticket cache on the client machine:
   

   klist purge

   Then try the EFS operation again.

Quick-Reference Summary Table

Most of the time, it's the certificate. Start there. If you still get the error after these three fixes, check the Application event log on both client and server for EFS-related errors. Sometimes a simple reboot after these changes does the trick.