Fix 0XC000028B STATUS_DECRYPTION_FAILED – File Won't Open

What triggers 0XC000028B?

You'll see this error when trying to open a file that Windows can't decrypt. I see it most often in two scenarios: you moved an encrypted file from a BitLocker drive to a non-encrypted drive, or you're using an old EFS (Encrypting File System) certificate that's no longer available. It usually pops up when you double-click a file and get a popup saying STATUS_DECRYPTION_FAILED with the code 0XC000028B.

The error number is 0xC000028B — in hex that's 0xC000028B. Windows stores it as STATUS_DECRYPTION_FAILED. It's not a virus, just a permission/certificate problem.

Let's fix it. You can stop after any section that works.

30-second fix: Reboot and check file location

Before you run any commands, try the simplest thing. Restart your computer. I've seen a stuck decryption service clear itself after a reboot.

If that doesn't help, check where the file lives. Right-click the file, choose Properties, then the General tab. Look at the Location field. If the path includes a drive that's no longer connected (like an external USB drive you unplugged), that's your problem. Reconnect that drive and try again.

Also check if the file is on a network share. Right-click it, pick Properties, then Security. If the share is mapped to a drive letter that changed (like from E: to F:), the decryption context breaks. Remap the share to the original letter: open Command Prompt as admin, type net use E: \\server\share /persistent:yes. Replace E: with the old drive letter and \\server\share with the actual network path.

5-minute fix: Run a system file check and dism

Sometimes the decryption service itself is corrupted. This fix is safe and takes about five minutes.

1. Press Windows Key + X, pick Terminal (Admin) or Command Prompt (Admin).
2. Type sfc /scannow and press Enter. Let it finish — it'll say either Windows Resource Protection found corrupt files and successfully repaired them or Windows Resource Protection did not find any integrity violations.
3. After that, type DISM /Online /Cleanup-Image /RestoreHealth and press Enter. This takes a few minutes. You'll see a progress bar. Once it says The restore operation completed successfully, reboot.

Try opening the file again. If it still fails, move to the next section.

15+ minute fix: Restore your EFS certificate or BitLocker key

If the file is encrypted with EFS (the built-in Windows file encryption, not BitLocker), you need the original certificate. I've fixed this for dozens of users who upgraded Windows or switched computers. Here's the process.

Step 1: Check if it's EFS encryption

Right-click the encrypted file, pick Properties, then General, then Advanced. If the Encrypt contents to secure data box is checked, it's EFS. If not, skip to BitLocker below.

Step 2: Find your EFS certificate

Open Start, type certmgr.msc, and press Enter. Click Personal > Certificates. Look for any certificate with Encrypting File System in the intended purposes column. If you see one, right-click it, choose All Tasks > Export, and follow the wizard to save it as a PFX file with a password (you'll need that password later).

If there's no EFS certificate here, that's why the decryption fails. You need to find the old certificate. Check:

• Your old computer's backup (look in C:\Users\YourUsername\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates for a .cer file)
• Any external hard drives you used with that old computer
• Cloud backups like OneDrive or Google Drive — search for files ending in .pfx or .cer

If you find the .pfx file, double-click it, follow the import wizard. You'll be prompted for the password you set during export. Once imported, reboot and try opening the file.

Step 3: If it's BitLocker

If the file is on a BitLocker-encrypted drive, the error usually means the drive's encryption key changed. This happens if you formatted the drive or removed it from the computer. You need the recovery key.

1. Open Control Panel > BitLocker Drive Encryption.
2. Find the drive with the error. Click Back up your recovery key if you haven't. The key is a 48-digit number. You'll find it in your Microsoft account (at https://account.microsoft.com/devices/recoverykey) or printed on a paper you saved.
3. Once you have the key, unlock the drive: open This PC, right-click the drive, choose Unlock Drive, then click More options > Enter recovery key. Type the 48-digit key.
4. After unlocking, copy the file to a non-encrypted folder (like C:\Users\YourName\Desktop). It'll decrypt during copy.

If the recovery key is lost, you're out of luck. BitLocker is designed to be unbreakable without the key. Your only option is a backup from before the drive was encrypted.

When to give up and use a backup

If none of this works, the encryption is toast. I've been there — it's frustrating. Your best bet is restoring the file from a backup made before encryption. If you don't have a backup, the file is gone. That's the harsh truth about encryption: it's secure even from you.

To avoid this in the future, export your EFS certificate every time you set it up. Store the .pfx file and the password in a safe place (I use a password manager and a USB stick). For BitLocker, always save the recovery key to your Microsoft account and print a copy.