| Event Id | 6022 |
| Source | EFS |
| Description | Cannot Create\Open EFSCACHE directory. Data:<Data> |
| Event Information | According to Microsoft: CAUSE: This behavior occurs if the permissions on the System Volume Information folder are modified so that System cannot write files. Encrypting File System (EFS) uses the System Volume Information folder on each volume to store its log file that is generated during the encryption and decryption process. By default, the System security principal has Full Control of that folder. RESOLUTION: To resolve this behavior, give the System security principal Full Control over the System Volume Information folder. |
| Reference Links | Access is Denied Error Message When Encrypting or Decrypting Files or Folders |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.