| Previous | Next |
| NTE_DEVICE_NOT_FOUND | NTE_PASSWORD_CHANGE_REQUIRED |
NTE_USER_CANCELLED
The important part of NTE_USER_CANCELLED is its scope: cancelled provider interaction. The provider stopped because the user dismissed or rejected a consent, PIN, certificate-selection, biometric, or key-protection prompt. Keep the hexadecimal value 0x80090036 with the returning API, because higher-level software may translate it into a message that loses this distinction.
Where the status is selected
The provider needs or attempted a user-presence step. Distinguish a silent-call contract, an unavailable interactive desktop, an explicit user cancellation, and a provider policy that limits the operation to the active console., they can present similarly in unattended software but require different fixes.
Evidence that changes the diagnosis
- 1. Silent and UI-related flags used when the provider or key was opened
Distinguish a deliberate cancel from a prompt that appeared on an inaccessible desktop and timed out. - 2. Session ID, desktop, active-console state, service identity, and whether a prompt was actually displayed
Record the session and provider UI path, but do not silently retry and reprompt in a loop. - 3. Key or device policy requiring consent, PIN entry, biometric verification, or certificate selection
Offer a clear retry action and preserve the operation state only if the API permits it.
For cancelled provider interaction, these observations are deliberately nonsecret: identifiers, lengths, provider names, policy selections, and state transitions usually support comparison without recording private keys, passwords, PINs, or plaintext.
Correlate the failure with state changes
Correlate the last successful operation with provider installation or update, key creation or renewal, profile or session changes, device insertion and removal, policy refresh, and the first failing call., the order matters: a provider error that starts immediately after a key migration suggests a different boundary from one that appears only after a service account changes.
- a minimal reproducer that names the API, provider, key or container, flags, and nonsecret input sizes.
- In the path, provider, device, profile, and operating-system event records covering the last success and first failure.
- In the path, a known-good control result produced under the same identity, architecture, and provider selection.
A controlled way to reproduce it
Run the same operation once in an interactive console session with provider UI allowed and once in the intended unattended context in a cancelled provider interaction investigation. Keep key and provider unchanged. The difference identifies whether the object itself is usable but bound to a user-presence policy.
| Test | Interpretation |
|---|---|
| Same input, known-good path | For cancelled provider interaction, success moves attention toward the selected provider, policy, device, context, or transaction state. |
| Known-good input, failing path | For cancelled provider interaction, failure suggests that the environment or selected object is independently unable to perform the operation. |
| Original path after one isolated change | For cancelled provider interaction, this comparison demonstrates whether the proposed correction addresses the original condition. |
Nearby results and misleading fixes
Treating this as an invalid password is misleading: the provider reports that the interaction did not complete. Automating or suppressing a PIN or consent dialog is not equivalent to provisioning a key for unattended use., do not weaken user-presence policy without confirming the security requirement.
For cancelled provider interaction, also retain the original numeric value; neighboring constants can encode materially different remediation paths even when an application presents all of them as an authentication, certificate, or security failure.
What counts as a real resolution
The operation must complete in its real deployment context using a key whose interaction policy matches that context, while preserving prompts where user approval is part of the design. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.
Technical references
These sources define the HRESULT and the relevant cancelled provider interaction interface, protocol, or data format.
- Microsoft Open Specifications: HRESULT values.
- Microsoft: CNG Key Storage Providers.
- Microsoft: CNG key storage functions.
Looking for a different code? Search another status or error code.