What program can Decrypt specific a Folder/Files during Windows Boot/Loading? (Windows)

Question

I've been looking into Encryption of my data for some time now; I've decided to move ahead with VeraCrypt for encryption all of my partitions (I have 2 disks in 1 laptop) except for the OS (C:) partition.

(Reason being, I don't want to risk the possible complications & potential data loss, eg. when trying to update Windows, there can be conflicts with VeraCrypt).

I would like however, to at least encrypt some portion(s) of my OS partition. Specifically, the "C:\Users" is my priority at this time.

If I am able to encrypt the "C:\Users" directory, I imagine that I would need this to be decrypted during system boot or Windows loading screen? (or at least before user login?) Otherwise the user data will be inaccessible to the system.

There are products such as AxCrypt, however, I'm not aware of it having any functionality to decrypt selected files/folders during system boot (please correct me if this is otherwise).

I would like to please know, are there any publicly available software that can accomplish what I'm seeking to do?

Or, is there any possible workaround otherwise (without doing full encryption of OS disk/partition)?

(Preferably an open source program, free or relatively inexpensive).)

(I currently have Windows 10 Home edition. I'm not interested in BitLocker or Windows 10 Pro at this time.)

Thank you.

---

Added Note:

I understand the risks of partial encryption (such as data leaks in swap/temporary files, etc...) I'm not very paranoid about bits of my data possibly being discovered in those cases, I don't really have high-risk data that needs protecting, but still, I'd like some protection rather than none.

---

To be clear, I would like to be able to:

1. Encrypt the "C:\Users" directory.
2. Upon Windows Boot/Load, be offered the option to decrypt the the "C:\Users" directory (which seems necessary before being able to load/login to user profiles).
3. After entering the correct password, the "C:\Users" directory will be decrypted, then Windows will continue to load/prepare user profiles for login.
4. I would like to avoid full disk/partition encryption.

Answer 1

First of all, encrypting only a directory is a Bad Idea.

You risk that crypto keys end up in the page/hibernation file, and is readable to all. Hibernation file has to be read at start of boot to restore state.

Second, you will have all kinds of leaks in temporary directories.

Set up bitlocker. It's integrated with the OS, and works fine across upgrades. I've been using Bitlocker on one laptop for four-five years, with zero problems. Whole disk encryption solves a lot of problems when it comes to possible unintended data leaks.

Answer 2

I am unaware of a software, that would exactly work as you described it.

However I would strongly advise against your described procedure, as it might not give you as much security as you would probably expect. See here for examples. I'd therefore recommend heading for full disk encryption which can easily be done i.e. with Veracrypt.

Do you have any specific reasons, why you would like to avoid full disk encryption?

In the end, it depends on your attacker model, which way to go. I guess there might be less software out there with your described procedure, as it won't defend well against common attacker models.