none
What is filecrypt.sys, the "Windows sandboxing and encryption filter" as per its description ?

    Question

  • I had to set it to manual startup because it was preventing the UAC virtualisation minifilter driver to work properly. However, maybe I could do something better if I knew what the bigger picture is.

    Seems it's a new Windows 10 piece of software, and I found nearly nothing about it...

    Thursday, April 14, 2016 9:30 PM

All replies

  • Hi NovHak,

    Please see the articles below:

    filecrypt.sys is listed in the article below:

    https://msdn.microsoft.com/en-us/library/windows/hardware/dn265170(v=vs.85).aspx

    It belongs to FSFilter Encryption group, which the group includes filter drivers that encrypt and decrypt data during file I/O.

    Reference here: https://msdn.microsoft.com/en-us/library/windows/hardware/ff549689(v=vs.85).aspx

    filecrypt.sys is one of minifilter drivers, which used together with fliter manager:

    https://msdn.microsoft.com/en-us/library/windows/hardware/ff541610(v=vs.85).aspx

    There is no more detailed information that I could find out about the filecrypt.sys specially.

    Regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    • Proposed as answer by Michael_LSModerator Monday, April 18, 2016 2:19 AM
    • Unproposed as answer by NovHak Monday, April 18, 2016 7:15 AM
    Friday, April 15, 2016 5:57 AM
    Moderator
  • Hi Michael, thanks for your reply.

    The last link you provided is interesting for people who want to know how minifilters work. In particular, it seems that file I/O is processed by decreasing order of altitude, while I thought it was going the other way, so it's good to know.

    However, I hope more information about the filecrypt driver will be available some day, even more so as its description suggests it may handle security critical tasks, which would be good to know more about in case one considers disabling it...

    Best regards !

    Friday, April 15, 2016 5:19 PM
  • Hi NovHak,

    I also would like to see more detailed information regarding Windows services, specially on Windows 10.

    Besides, if any further questions regarding Windows 10 usage, please feel free to ask in TechNet.

    Regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Monday, April 18, 2016 2:19 AM
    Moderator
  • Hi Michael,

    I'm surprised that you proposed your post as an answer. The point of this thread was to get information about the role of the filecrypt filesystem minifilter driver. As of now, the only specific facts we know about it are its interference with luafv.sys and its description, both of which I knew before coming here. Disabling it may even be a security risk, but who knows finally ?

    So why hurry to close this case ? I would rather advise that the question remains open...

    Monday, April 18, 2016 7:38 AM
  • My Apology.

    OK.

    I will just monitor this one.

    And as there is no specific answer to the issue currently, you may consider to change the type into discussion.

    Regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Monday, April 18, 2016 9:13 AM
    Moderator
  • Windows is not open source software. It is not easy to find out what a particular sys or dll does.


    Bill

    Monday, April 18, 2016 9:52 AM
  • @Bill : Agreed, but not being open source should not serve as an excuse to leave parts of it unspecified.

    Your first name is Bill, you're retired, but you're clearly not the one :D

    @Michael : That's OK. However, why changing the type into discussion ? It IS a question, the fact it's not answered yet doesn't mean it isn't one. Moreover, unless Windows 10 has been created by God, there are people here on earth who have the answer. People from Microsoft, more precisely...

    Monday, April 18, 2016 10:27 PM