This object monitors replication and creates a Warning alert if any files encrypted by using the Encrypting File System (EFS) are found in a replicated folder. It does so by looking for the presence of DFS Replication Event 4402. DFS Replication doesn’t replicate files encrypted by EFS.
An unhealthy state of this monitor indicates that DFS Replication found a file encrypted by EFS in a replicated folder. This can occur if a user used EFS to encrypt a file stored in a replicated folder.
Decrypt or remove the file
To replicate the file, decrypt it by using the Cipher /d <filename> command where <filename> is the path to the encrypted file. After the file is decrypted, it will replicate normally.
If the file should remain encrypted, move it out of the replicated folder, or decrypt it and then encrypt it by using a non-Microsoft encryption program that doesn’t set the FILE_ATTRIBUTE_ENCRYPTED attribute on the file.