4.11.11. EFS

The EFS (Encrypted File System) subsystem runs one RPC service, efsrpc, used to communicate with the service that implement cryptographic operations on the local system.

Table 4.83. efsrpc operations

InterfaceOperation numberOperation name
c681d488-d850-11d0-8c52-00c04fd90f7e v1.0: efsrpc  
 0x00EfsRpcOpenFileRaw
 0x01EfsRpcReadFileRaw
 0x02EfsRpcWriteFileRaw
 0x03EfsRpcCloseRaw
 0x04EfsRpcEncryptFileSrv
 0x05EfsRpcDecryptFileSrv
 0x06EfsRpcQueryUserOnFile
 0x07EfsRpcQueryRecoveryAgents
 0x08EfsRpcRemoveUsersFromFile
 0x09EfsRpcAddUsersToFile
 0x0aEfsRpcSetFileEncryptionKey
 0x0bEfsRpcNotSupported
> Windows XP and Windows Server 20030x0cEfsRpcFileKeyInfo
 0x0dEfsRpcDuplicateEncryptionInfoFile
> Windows Vista0x0eEfsUsePinForEncryptedFiles
 0x0fEfsRpcEncryptFileCse
 0x10EfsRpcDecryptFileSrvEx
 0x11EfsRpcRemoveUsersFromFileEx
 0x12EfsRpcAddUsersToFileEx
 0x13EfsRpcDuplicateEncryptionInfoFileEx
 0x14EfsRpcFileKeyInfoEx
 0x15EfsRpcGenerateEfsStream
 0x16EfsRpcGetEncryptedFileMetadata
 0x17EfsRpcSetEncryptedFileMetadata
 0x18EfsRpcFlushEfsCache