Overview

In real-world environments, encryption and decryption operations can be interrupted by system restarts, connectivity issues, or user intervention. As a result, files may remain in an inconsistent encryption state, making troubleshooting, auditing, and recovery more difficult. With enhanced diagnostic and remediation capabilities for NSE‑encrypted folders introduced in Endpoint Data Protection 26.1, covering both managed systems with an EgoSecure Agent and unmanaged systems without one, this article describes the new encryption state diagnostics and recovery capabilities, including how to analyze NSE‑encrypted folders and, where possible, repair interrupted encryption or decryption processes.

With the Cryption Informer, administrators and support engineers can now analyze NSE‑encrypted folders and determine the encryption state of individual files. When the EgoSecure Agent and the required encryption keys are present, the Cryption Informer can also repair interrupted encryption or decryption processes, restoring a consistent and operational state without reconfiguration.

For systems without an EgoSecure Agent, a standalone analysis script is provided. The script allows administrators to inspect NSE‑encrypted folders and export the encryption state of files (for example, encrypted vs. unencrypted) without requiring agent installation or access to encryption keys. This is particularly useful for audits, investigations, and environments where remediation is not required. 

Diagnosing and Repairing NSE Encryption States on Managed Systems

This method is intended for managed systems where the EgoSecure Agent is installed. Using Cryption Informer, administrators can analyze NSE-encrypted folders, identify files with an inconsistent encryption state, and restore the intended encryption or decryption state when required

Prerequisites

• EgoSecure Agent installed
• Required NSE encryption keys available for the logged on user
• Access permissions to the target folder or network share

Analyzing Folder Encryption States with Cryption Informer

This check should be performed from the computer and user account that is configured to encrypt/decrypt the folder, or from an account that has access to the folder and the required encryption keys.

• Open a Command Prompt.
• Replace the placeholder path and run the following command:
  
  • "C:\Program Files\EgoSecure\EgoSecure Agent\CryptionInformer.exe" check_cryption \\MachineName\PathToNSEFolder\
• This command opens the Cryption Informer dialog.
• Example:
  • "C:\Program Files\EgoSecure\EgoSecure Agent\CryptionInformer.exe" check_cryption \\AV-WINSERVER202\SharedFolder1
• Before running the command, note the following:
  • The full path to CryptionInformer.exe must be specified and enclosed in quotation marks.
  • The network share path must not be enclosed in quotation marks, even if it contains spaces.

Review Scan Results

The example below shows the scan results for a folder that was intentionally configured to contain unencrypted files. The results can be sorted by clicking the Path or Status column headers. After the scan is completed, the results remain available even after the dialog has been closed. They can be reviewed in the following locations:

• The Cryption Informer log file (if the Agent is configured to generate debug-level logs).
• The CSV export file named EncryptionStatus_<date>.csv.

Both files can be found in the following directory: C:\ProgramData\EgoSecure\EgoSecureAgent\LOG

Repairing Folder Encryption States with Cryption Informer

If a Cryption Informer scan reveals that a folder is in an inconsistent state, the tool can also be used to restore the intended encryption state. Examples of inconsistent states include:

• An encrypted directory containing unencrypted files.
• A decrypted directory containing encrypted files.

To restore the intended encryption state, open a Command Prompt, adjust the target path, and run the following command:

• "C:\Program Files\EgoSecure\EgoSecure Agent\CryptionInformer.exe" continue_cryption \\MachineName\PathToNSEFolder\

Running this command launches the standard encryption/decryption process. Once the operation has completed successfully, the dialog should look similar to the example shown below (encryption example).

Review Recent Remediation

After the repair operation has completed, it is recommended to run another scan using the check_cryption command to verify the result and generate an updated CSV report for documentation purposes.

"C:\Program Files\EgoSecure\EgoSecure Agent\CryptionInformer.exe" check_cryption \\MachineName\PathToNSEFolder\

Diagnosing NSE Encryption States on Unmanaged Systems

This method is intended for environments where no EgoSecure Agent is installed on the system being analyzed. Using the standalone PowerShell Scanner, administrators can inspect NSE-encrypted folders and determine the encryption state of individual files without requiring agent installation or access to encryption keys. The scanner is particularly useful for audits, troubleshooting, post-migration validation, and investigations on file servers or network shares where only analysis is required and no remediation actions are planned.

Prerequisites

• No EgoSecure Agent installed on the system where the script will be executed.
• Read access to the target folder or network share.
• The script can be executed either directly on the file server or from any system with access to the target share.

Download the Script 

Download the PowerShell Cryption Scanner package from the link below:

EgoSecure_Cryption_Scanner_v2_2.zip

Using the Scanner

• Extract the downloaded archive.
• Launch the PowerShell scanner (e.g. EgoSecure_Cryption_Scanner v2_2.ps1).
• The main interface opens as shown below.
• Click Scan on File Server (without Agent).

• Press Select Directory and choose the folder to analyze.
• Click OK to confirm your selection.

• Click Start Scan to begin the scan.
• After the scan completes, the tool displays:
  • The scanned files
  • The encryption status of each file
  • Any access-related errors encountered during the scan
  • A summary of the overall results
• The scan results can also be exported, allowing you to generate separate file lists for:
  • Encrypted files
  • Unencrypted files
  • Files that could not be analyzed due to access errors

Encrypted folder:

Unencrypted folder: