What does HRESULT 0x80090033 (NTE_INCORRECT_PASSWORD) mean?

NTE_INCORRECT_PASSWORD

NTE_INCORRECT_PASSWORD concerns provider credential rejection. The provider evaluated the supplied password, PIN, or protected-key credential and determined that it does not unlock the requested key or token state.

Start with the returning API

Protected providers can distinguish a wrong secret, an expired secret that must be changed, and a mitigation state in which new attempts are ignored. Preserve attempt timing and provider state; otherwise all three can be flattened into a generic PIN or password failure by the application.

Diagnostic evidence matrix

1. 1. Provider and device identity, credential type, attempt count, lockout or throttling state, and timestamps
   Confirm which credential the provider expects; account passwords, PFX passwords, token PINs, and key-protection passwords are not interchangeable.
2. 2. Whether the secret was rejected, accepted but expired, or not evaluated
   Avoid logging the secret while still recording credential source, key name, provider, and attempt count.
3. 3. The supported password-change or unblock workflow for the specific provider
   Check lockout policy before retrying and prompt once through the provider-approved UI.

For provider credential rejection, these observations are deliberately nonsecret: identifiers, lengths, provider names, policy selections, and state transitions usually support comparison without recording private keys, passwords, PINs, or plaintext.

What to include in an escalation package

• A known-good control result produced under the same identity, architecture, and provider selection.

Minimal test sequence

Stop automated retries. After the provider-defined cooldown or administrative recovery, make one labeled attempt with a known valid test credential on a nonproduction object in a provider credential rejection investigation. For expiry, use the supported change workflow rather than repeatedly presenting the old value.

1. Use one known-good control that changes only the suspected part of the provider credential rejection path.
2. Record where behavior first diverges in the provider credential rejection path instead of judging only by the final application message.

Scope of this HRESULT

NTE_AUTHENTICATION_IGNORED means mitigation prevented normal evaluation; this code means an actual credential check failed. Do not infer that credentials are wrong when the provider says they were ignored, and do not clear the state by resetting the token before recording lockout evidence in a provider credential rejection investigation.

For provider credential rejection, also retain the original numeric value; neighboring constants can encode materially different remediation paths even when an application presents all of them as an authentication, certificate, or security failure.

Closure criteria

The provider must evaluate the credential normally, enforce its retry policy, and complete the protected operation after any required change or recovery procedure.

Technical references

These sources define the HRESULT and the relevant provider credential rejection interface, protocol, or data format.

• Microsoft Open Specifications: HRESULT values.
• Microsoft: CNG Key Storage Providers.
• Microsoft: CNG key storage functions.