Page File Encryption - Enable or Disable

How to Enable or Disable Page File Encryption in Vista and Windows 7​

   Information

This will show you how to enable or disable encrypting the virtual memory page file in Vista and Windows 7.

Encrypting the page file prevents malicious users from reading data that has been paged to a NTFS disk, but will also add processing overhead for file system operations.

You must be logged in as an administrator to be able to do this tutorial.

OPTION ONE

Using a REG File Download

1. To Enable Page File Encryption
A) Click on the Download button below to download the file below.
Enable_Page_File_Encryption.reg

Download


B) Go to step 3.
2. To Disable Page File Encryption
NOTE: This is the default setting.
A) Click on the Download button below to download the file below.
Disable_Page_File_Encryption.reg

Download


3. Click on Save, and save the .reg file to the desktop.

4. Right click on the downloaded .reg file and click on Merge.

5. Click on Run, Continue (UAC-Vista) or Yes (UAC-Windows 7), Yes, and OK when prompted.

6. Restart the computer to apply.

7. When done, you can delete the downloaded .reg file if you like.

OPTION TWO

Through the Local Group Policy Editor

NOTE: This option is only available in Windows 7, and is not in Vista.
1. Open the Local Group Policy Editor.
2. In the left pane, click on to expand Computer Configuration, Administrative Templates, System, Filesytem, and NTFS. (see screenshot below)

3. In the right pane, right click on Enable NTFS pagefile encryption and click on Edit. (see screenshot above)

4. To Disable Page File Encryption
NOTE: This is the default setting.
A) Select (dot) either Not Configured or Disabled. (see screenshot below step 6)
B) Go to step 6.
5. To Enable Page File Encryption
A) Select (dot) Enabled. (see screenshot below step 6)
6. Click on OK. (see screenshot below)

7. Close the Local Group Policy Editor window.

8. Restart the computer to apply.

OPTION THREE

Using a Elevated Command Prompt

1. Open a elevated command prompt (Run as administrator).

2. To Enable Page File Encryption
A) In the elevated command prompt, copy and paste the command below and press Enter.
fsutil behavior set encryptpagingfile 1
B) Go to step 4.
3. To Disable Page File Encryption
NOTE: This is the default setting.
A) In the elevated command prompt, copy and paste the command below and press Enter.
fsutil behavior set encryptpagingfile 0
4. Close regedit, and restart the computer to apply.

5. To Verify the Page File Encryption Setting
A) Open a elevated command prompt.

B) In the elevated command prompt, copy and paste the command below and press Enter.
NOTE: 0 = disabled and 1 = enabled
fsutil behavior query encryptpagingfile
That's it,
Shawn

Related Tutorials

---

• How to Enable or Disable "Clear Virtual Memory Paging File at Shutdown" in Vista and Windows 7
• How to Change the Virtual Memory Paging File in Vista and Windows 7

 

[StalkeR]

Very nice.. as usual Shawn!

 

[Brink]

Thank you Boshko.

 

[EzioAuditore]

Thank you Shawn, just did it.

By the way, I think a mistake's there in language. The part in blue seems to have inter-changed.

4. To Enable Page File EncryptionA) Select (dot) either Not Configured or Disabled. (see screenshot below step 6)
B) Go to step 6.
5. To Disable Page File Encryption
NOTE: This is the default setting.A) Select (dot) Enabled. (see screenshot below step 6)

 

[Fayla]

Interesting option! I tried enabling it via the registry file but it told me that "the key did not exist"? So I just configured it via the GP Editor.

 

[Brink]

Thank you Shawn, just did it.

By the way, I think a mistake's there in language. The part in blue seems to have inter-changed.

4. To Enable Page File Encryption
A) Select (dot) either Not Configured or Disabled. (see screenshot below step 6)

B) Go to step 6.

5. To Disable Page File Encryption
NOTE: This is the default setting.A) Select (dot) Enabled. (see screenshot below step 6)

Thank you Ezio. It has been corrected.

 

[Brink]

Interesting option! I tried enabling it via the registry file but it told me that "the key did not exist"? So I just configured it via the GP Editor.

Hello Lost Colonist,

Was it a "file association does not exist..." type error instead?

When you right click on the REG file, did you have a Merge option in the context menu?

Were you logged in an adminsitrator account when using the REG file?

 

[Windows 911]

Hello guys, I am wondering if I should encrypt the virtual page file... or just have it deleted on shutdown. What do you recommend? Or should I even bother with it? I just have a simple laptop..

 

[Brink]

Hello Windows 911,

Usually you would only encrpyt or delete the page file on exit if you are concerned about the possibily of someone reading it's contents. Encrypting the page file will get a small negative performance hit in Windows since it will take a bit longer to encrypt and decrypt everything in and out of the page file. Deleting the page file on exit will cause a delay at shutdown while you wait on the page file to be deleted.

I would not recommend to turn off the page file. Some programs, usually older ones though, will require the page file to be turned on for them to run properly no matter how much RAM you have installed.

Hope this helps some,
Shawn

 

[Windows 911]

Thank you for the quick reply Im thinking about encrypting at least, especially that I carry my computer around frequently. Is the performance impact negligible, or obvious? I don't care if it adds a couple seconds to startup or shutdown. Do you use it on your system Brink?

 

[Brink]

No, I don't encrypt my page file.

It may vary from system to system on how much you may notice anything or not with it being encrypted. If it seems to slow afterwards, you can always unencrypt it.

 

[Windows 911]

I just encrypted it using your first method. Thank you for these tutorials Brink, they are excellent! I also rebooted, and I think I only lost 4 seconds or so. I'll keep it on for peace of mind.

 

[Brink]

You're most welcome mate.

 

[NoN]

Thanks Shawn, applyed the tip through local group policy editor!

 

[Brink]

You're welcome NoN.

 

[Prune]

Hi, I saw this thread over at the Vista forum as well (and I'm running Vista Business x64 still though will be upgrading) and I posted here due to the larger traffic at this forum.

Restarting my computer turns off the paging file encryption--every time I tried it, regardless of method.

When I make the changes suggested in the first post, if I then check with "fsutil behavior query encryptpagingfile" it shows 1 until I restart or turn off and then on the computer; after the restarts it shows 0 again !

Same thing with the registry method. Though in my registry there is no [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies] (specifically, there's no Policies in CurrentControlSet), I did merge that .reg file, and in addition I manually modified [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\FileSystem] NtfsDisableEncryption to 1, however after every restart it gets reset to 0 !!

I tried the local group policy editor method as well, and the option to encrypt the paging file doesn't even show up in the list of entries I can modify (also the path to the filesystem settings on my system is not "Computer Configuration, Administrative Templates, System, Filesytem, and NTFS" but "Computer Configuration, Administrative Templates, System, NTFS Filesytem") !!!

How do I fix this problem? It's an issue because I am now in a situation where I need to protect certain data with TrueCrypt and so I must encrypt the paging file or risk the password being stored into it (and I am unable to use the whole disk encryption due to multi-boot configuration). Please help!

PS I have SpyBotS&D installed but I killed the TeaTimer process (the tool that prevents some registry changes) before trying these methods. I additionally tried to make these changes from within Safe Mode but the reset to no encryption still happens...

 

[Brink]

Hello Prune, and welcome to Seven Forums.

Looking at the The Cipher.exe utility does not correctly detect the encryption status of the system pagefile (Pagefile.sys) on a computer that is running Windows Vista Service Pack 1 or Windows Server 2008 article at the link below, if NtfsEncryptPagingFile set to 1 at the location below, then the page file is suppose to be encrypted in Vista. I have updated the REG files in the tutorial to include this as well.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem

 

[Prune]

Hi Brink, thanks for the prompt reply.

I tried setting that registry entry, but again it gets reset to 0 when I restart. So either when the computer is shutting down or when it's starting up, Windows itself or some application must be changing it. I'm really at a loss here...

 

[Brink]

Prune,

I'm not sure what else may be resetting it either like that.