Allow indexing of encrypted files

This machine-level registry value controls whether Windows Search may index encrypted files and encrypted stores.

since 0.9.8.11

Purpose

Show registry keys (1)

HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\AllowIndexingEncryptedStoresOrItems

This machine-level registry value controls whether Windows Search may index encrypted files and encrypted stores. It is a REG_DWORD value:

1 permits indexing. Windows Search attempts to decrypt accessible encrypted content and add its contents and properties to the search index.
0 prevents indexing. Search service components, including integrated non-Microsoft components, are expected not to index encrypted items or encrypted stores.

The setting does not supply decryption keys or grant additional file permissions. Existing access restrictions remain in effect. If the policy value is absent, Windows uses the local setting for indexing encrypted content; that local setting is disabled by default.

Notes

Additional effects

When indexing is allowed, items protected by Windows Information Protection (WIP) are also indexed on systems where WIP is in use.

When indexing is prevented, encrypted items do not appear in index-backed search results such as those in File Explorer. If the device contains many WIP-protected media files, search performance in Photos and other media applications can also be affected.

Security

Windows Search processes decrypted content during indexing and stores search information derived from it in the index. Microsoft therefore specifies that the volume containing the search index must use full-volume encryption, such as BitLocker, to preserve the security of encrypted files.

For WIP-protected items, metadata including the file path and modification date is stored in an unencrypted location. This can expose information about protected files outside their original encrypted storage. The policy does not, however, bypass access control lists or other permissions on the original files.

Possible side effects

Changing between allowed and blocked indexing causes Windows to rebuild the entire search index.

Microsoft documentation

Microsoft Learn: Search Policy CSP – AllowIndexingEncryptedStoresOrItems