WINDOWS SERVICE
EFS: Encrypting File System (EFS)
Provides the core file encryption technology used to store encrypted files on NTFS file system volumes.
TECHNICAL SUMMARY
| Service name | EFS |
|---|---|
| Display name | Encrypting File System (EFS) |
| Runs from | C:\Windows\System32\lsass.exe |
| Command line | lsass.exe |
| Runs as | LocalSystem |
| Signed by | Microsoft Windows |
| Verdict | Leave it alone |
| Microsoft, Windows Server 2016 guidance | No guidance |
Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneMicrosoft states that if it is stopped or disabled, applications cannot access encrypted files, and its guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable. Its default startup type is Manual and it has a start trigger, so it costs nothing while idle: on the PC used for this page it was stopped.
What PC Tweaker does with it
PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.
Check it yourself
See its state and start type
PowerShellGet-Service EFS | Format-List Name, DisplayName, Status, StartType sc qc EFS
Common questions
What does the EFS service do?
Provides the core file encryption technology used to store encrypted files on NTFS file system volumes. It runs C:\Windows\System32\lsass.exe (lsass.exe) as LocalSystem.
Can I disable EFS?
Leave it alone. Microsoft states that if it is stopped or disabled, applications cannot access encrypted files, and its guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable. Its default startup type is Manual and it has a start trigger, so it costs nothing while idle: on the PC used for this page it was stopped.
Is EFS the same as BitLocker?
No. Microsoft describes the Encrypted File System as cryptographic protection of individual files on NTFS volumes, using a public-key system. BitLocker has a service of its own, BDESVC (BitLocker Drive Encryption Service). To see whether files are EFS-encrypted, Microsoft documents cipher: used without parameters, it displays the encryption state of the current directory and the files it contains.
Why is the EFS service registered under lsass.exe?
Microsoft documents that the EFS service is hosted in lsass.exe. On Windows 11 build 26300 the service's command line is C:\Windows\System32\lsass.exe, it loads C:\Windows\system32\efssvc.dll, signed by Microsoft Windows, and it depends on RpcSs.