Fix STATUS_EFS_ALG_BLOB_TOO_BIG (0xC0000352)

You're probably swearing at your screen right now

I know that feeling. You try to encrypt a file or folder, and Windows throws STATUS_EFS_ALG_BLOB_TOO_BIG (0xC0000352) back at you. It's one of those errors that makes no sense until you've seen it a dozen times. I've seen it on Windows 10, Windows 11, and even Server 2019. Here's the fix.

The Fix: Clear the EFS Cache

Don't bother reinstalling anything. Don't run sfc /scannow yet. The culprit here is almost always a bloated EFS certificate or a corrupted cache file.

Open Command Prompt as Administrator.
Type this and hit Enter — it stops the EFS service:
```
net stop EFS
```
Now delete the cache. Run:
```
del /q /f %ALLUSERSPROFILE%\Microsoft\Crypto\RSA\MachineKeys\*.*
```
Warning: This clears machine-level EFS keys. If you rely on those, back them up first (see below).
Restart the EFS service:
```
net start EFS
```
Try encrypting your file again. Should work now.

Real-world trigger: This error happens most often when you've been using EFS for years, or after a Windows feature update. The blob — the encrypted data that holds your key — gets too large for the system to process in one call. Typical scenario: you encrypted a whole folder tree, then added more users to the certificate, and the blob size grew beyond the 64KB limit.

Why This Works

EFS stores key blobs in the MachineKeys folder. Each blob holds encrypted copies of the file encryption key. If you have lots of users or lots of certificates, those blobs can hit a size limit (around 64KB). Deleting the cache forces Windows to rebuild the blobs from scratch, usually smaller.

Another common cause: a malformed certificate chain. If you have expired or self-signed certs in your personal store, EFS tries to include them all in the blob. That bloats it fast. Check with:

certutil -store MY

Look for expired or duplicate certificates. Delete the junk with certlm.msc (Local Machine) or certmgr.msc (Current User).

Less Common Variations of This Issue

1. Key Size Too Large

If you created an EFS certificate with a 4096-bit RSA key, that's often the problem. Windows expects 2048-bit keys. To fix:

Open certlm.msc.
Expand Personal > Certificates.
Find your EFS certificate (usually has "File Encryption" or "EFS" in the name).
Right-click > All Tasks > Export. Include private key, set a password.
Delete the certificate from Personal.
Create a new EFS cert with default settings.
Import the old cert for reading old files only.

2. Corrupted EFS Registry Entry

Rare, but I've seen it. The registry value HKLM\SYSTEM\CurrentControlSet\Services\EFS\Parameters\EncryptionAlgorithmId can get corrupted after a bad install. Delete that key (not the whole Parameters folder) and reboot.

3. Group Policy Override

If you're on a domain, group policy might force a specific encryption algorithm that doesn't match. Check gpedit.msc > Computer Configuration > Windows Settings > Security Settings > Public Key Policies > Encrypting File System. If it's set to something weird like 3DES, change it to "Use default" or AES-256.

Prevention Tips

Keep EFS certs clean. Don't let old certificates pile up. If you rotate keys, remove the old ones from your personal store.
Stick with 2048-bit keys. Don't go bigger unless you really need it. The security difference between 2048 and 4096 is tiny for most use cases, but the blob size difference is huge.
Back up your EFS certificates. Seriously. When this error strikes, people panic and delete things. Export your certs to a PFX file and store it somewhere safe. You can do that from certlm.msc.
Test after feature updates. Windows 10 22H2 and Windows 11 23H2 both had issues with EFS blob size. Run a test encryption after each update.

One last thing — if you're encrypting files that need to be shared, consider using BitLocker instead. EFS is great for individual files, but it's a pain to manage. I switched my clients to BitLocker years ago and never looked back.