Share via


What is filecrypt.sys, the "Windows sandboxing and encryption filter" as per its description ?

Question

Thursday, April 14, 2016 9:30 PM | 1 vote

I had to set it to manual startup because it was preventing the UAC virtualisation minifilter driver to work properly. However, maybe I could do something better if I knew what the bigger picture is.

Seems it's a new Windows 10 piece of software, and I found nearly nothing about it...

All replies (7)

Friday, April 15, 2016 5:57 AM | 1 vote

Hi NovHak,

Please see the articles below:

filecrypt.sys is listed in the article below:

https://msdn.microsoft.com/en-us/library/windows/hardware/dn265170(v=vs.85).aspx

It belongs to FSFilter Encryption group, which the group includes filter drivers that encrypt and decrypt data during file I/O.

Reference here: https://msdn.microsoft.com/en-us/library/windows/hardware/ff549689(v=vs.85).aspx

filecrypt.sys is one of minifilter drivers, which used together with fliter manager:

https://msdn.microsoft.com/en-us/library/windows/hardware/ff541610(v=vs.85).aspx

There is no more detailed information that I could find out about the filecrypt.sys specially.

Regards

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].


Friday, April 15, 2016 5:19 PM | 1 vote

Hi Michael, thanks for your reply.

The last link you provided is interesting for people who want to know how minifilters work. In particular, it seems that file I/O is processed by decreasing order of altitude, while I thought it was going the other way, so it's good to know.

However, I hope more information about the filecrypt driver will be available some day, even more so as its description suggests it may handle security critical tasks, which would be good to know more about in case one considers disabling it...

Best regards !


Monday, April 18, 2016 2:19 AM | 1 vote

Hi NovHak,

I also would like to see more detailed information regarding Windows services, specially on Windows 10.

Besides, if any further questions regarding Windows 10 usage, please feel free to ask in TechNet.

Regards

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].


Monday, April 18, 2016 7:38 AM | 1 vote

Hi Michael,

I'm surprised that you proposed your post as an answer. The point of this thread was to get information about the role of the filecrypt filesystem minifilter driver. As of now, the only specific facts we know about it are its interference with luafv.sys and its description, both of which I knew before coming here. Disabling it may even be a security risk, but who knows finally ?

So why hurry to close this case ? I would rather advise that the question remains open...


Monday, April 18, 2016 9:13 AM | 1 vote

My Apology.

OK.

I will just monitor this one.

And as there is no specific answer to the issue currently, you may consider to change the type into discussion.

Regards

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].


Monday, April 18, 2016 9:52 AM | 1 vote

Windows is not open source software. It is not easy to find out what a particular sys or dll does.

Bill


Monday, April 18, 2016 10:27 PM

@Bill : Agreed, but not being open source should not serve as an excuse to leave parts of it unspecified.

Your first name is Bill, you're retired, but you're clearly not the one :D

@Michael : That's OK. However, why changing the type into discussion ? It IS a question, the fact it's not answered yet doesn't mean it isn't one. Moreover, unless Windows 10 has been created by God, there are people here on earth who have the answer. People from Microsoft, more precisely...