Share via

Could not open the document because the file is locked. Use the 'Properties' command in the Windows Explorer to unlock the file.

Anonymous
2011-01-27T18:28:01+00:00

I am a member of the administrators group on my computer.  I have a folder full of files and other folders that I have denied access to non-administrator users.  Not sure when it occurred as I was gone for the holidays, but now I am unable to open any files located within this folder.  I can delete, move and rename at will, but cannot open.  I have attempted all permissions resets I can think of as well as read through all the knowledge base articles I can find but still cannot get these files to open.

I recently updated MS Security Essentials, not sure if this has any correlation.

At one point I viewed the certificate and it listed it as not trusted.  How would this change?  Would this impact my ability to open the files yet still let me move, delete and rename them?  If so, how can I resolve?

I did restore to a previous restore point and still not open - also rcvd an error telling me MS Security Essentials would not work properly.  So I undid the restore.

Thank you in advance for any input.  PatrixUSA

Windows for home | Previous Windows versions | Files, folders, and storage

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

Answer accepted by question author

Anonymous
2011-01-28T20:39:50+00:00

Actually, this is beginning to make a lot of sense now.  The files you are having problems with have been encrypted with EFS.  EFS is closely tied to the NTFS file system.  As long as you move encrypted files around in the same Volume, this is not a problem because a move is a directory operation and directories themselves are not encrypted (only the files within them are).  Any time you move an encrypted file from one volume to another, the file must be decrypted, transferred to the other volume, then re-encrypted at the destination.  Thus, the destination volume must also be a NTFS file system to keep the files encrypted.  If the destination is not a NTFS volume, then the copy would result in an unencrypted file existing at the destination and you should be prompted as to whether to allow the operation or not.  In any case, a volume-to-volume copy requires decryption of the file and any operation that requires decryption is generating an access error to you -- that plus your inability to normally open a file indicates that you no longer control the certificate to decrypt the file.

Backups are another matter.  If you use Microsoft's Backup utility (NTbackup), then it recognizes the encrypted file attribute and backs it up as-is without decrypting it.  Other 3rd party backup programs may not recognize encrypted files and simply read them and write them to the backup medium.  When this happens, the files are automatically decrypted upon reading (assuming archiving user has needed certificates) and written to backup as an unencrypted file.  This would explain why you can retrieve an archive and it doesn't appear encrypted.  DVD and optical tape do not use NTFS so a decryption of original file is required to back up to these media.

The private part of your EFS encryption certificate (needed to decrypt files) is stored itself encrypted on your computer.  To decrypt it, Windows uses your SecureID, your password, and other things of which I'm unaware.  If your password is not reset the normal way (ie by entering your current password and your new password) such as by an administrator, then your certificate is not re-encrypted to your new password and your lose access to it and with it, access to your EFS files.  Other forms of corruption can cause you to lose your certificate but it appears as though at some point you have lost access to your certificate and thus cannot access files that were encrypted under that certificate.

New files that you write to a directory that has been enabled with EFS will notice that you don't have a valid certificate and then automatically generate a new certificate that will be used to encrypt files from that point forward.  That is why new files that you add to this directory seem to work well.  The only real mystery that I can't explain is why a system restore to a time when this wasn't a problem didn't allow you to regain access.

If you want some heavy reading, try this:

"Encrypting file System in Windows XP and Windows Server 2003"

  < http://technet.microsoft.com/en-us/library/bb457065.aspx >

Personally, I'm not a fan of EFS because of issues just like this.  I prefer the freewareTruecrypt which is just as secure but I myself manage the keys (in form of passphrase) instead of Windows.  It also hides filenames and can be used securely over a networked connection and backups from the Windows volume are encrypted no matter how they're done.  I haven't lost any encrypted data in over ten years.

HTH,

  JW

Was this answer helpful?

1 person found this answer helpful.
0 comments No comments

15 additional answers

Sort by: Most helpful
  1. Anonymous
    2011-01-27T22:06:37+00:00

    The certificate does not make sense to me.  Exactly which certificate is corrupted?  If it's a Root certificate, you can download/update your root Certificates from a Microsoft site .  AFAIK, you only need certificates when you do a secure connection in the internet (https://) or use/access an "Encrypting File System" (EFS)-encrypted file.  You did mention that the file was "locked".  Usually "locked" means that another user or process has attached to this file and it is in use. When this happens, the symptoms can be much like what you describe.  If this were the case, I would expect that if you boot to Safe Mode (in which case many superfluous processes are not running), then access would return to normal.

    If this turns out to be the case, there is a freeware program called "unlocker" that can break the locks on files such as this -- although I would be curious to know what process/procedure/user has placed the lock on this file.

    Unlocker:  < http://download.cnet.com/Unlocker/3000-2248_4-10493998.html >

    HTH,

      JW

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2011-01-27T21:26:48+00:00

    Thanks Wunders - Simple File Sharing has long been deselected and is listed as such when I rechecked it when first troubleshooting this issue.  Just rechecked and can confirm it is not checked... I think maybe somehow the security certificate has been corrupted?, guessing... as I can think of no other reason why this would happen...

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2011-01-27T20:57:22+00:00

    To change permissions, you need to use the "Security" tab in the Properties window.  It will depend on your OS as to how to do this.  If you have XP Pro, then you must disable "Simple File Sharing" to gain access to this tab.  If you have XP Home, you must boot to Safe Mode to get access to this tab.  The following article applies to XP Pro, but despite what it says in the intro paragraph, it will also work on XP Home if you boot in Safe Mode.  Also you may have to look at both folder and file permissions.

    "How to disable simple file sharing and how to set permissions on a shared folder in Windows XP"

      < http://support.microsoft.com/kb/307874 >

    HTH,

      JW

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2011-01-27T19:09:54+00:00

    UPDATE - As well as being able to delete, move and rename files within the folder in question, I can also save to the folder in question and afterwards open newly saved files within this folder.  But I still cannot open files that existed prior to discovering this issue.  Any thoughts by anyone?

    Was this answer helpful?

    0 comments No comments