| Previous | Next |
| NAP_E_SERVICE_NOT_RUNNING | NAP_E_NETSH_GROUPPOLICY_ERROR |
NAP_E_ENTITY_DISABLED
The NAP entity is disabled
NAP_E_ENTITY_DISABLED is HRESULT 0x8027000E (signed decimal -2144927730, unsigned decimal 2150039566). AllStat, using winerror.h, describes it as “The entity is disabled with the NapAgent service.” The value has failure severity, facility 0x27, and code field 0x000E.
This is a legacy Network Access Protection result: Microsoft states that NAP is unavailable starting with Windows 10 and that current Windows Server releases do not include the former NAP, HRA, and HCAP roles; use the code for supported legacy systems, archived telemetry, compatibility components, or migrations rather than assuming a modern machine should expose the old platform.
Registration exists, but participation is administratively blocked
NAP_E_ENTITY_DISABLED says NapAgent knows the entity but will not use it because it is disabled. The entity may be an SHA or enforcement component depending on the method that returned the code. This is materially different from a missing registration, a stopped agent service, or an unhealthy endpoint: it is control-plane state for the component itself.
Why a registered entity is disabled
- An administrator or policy intentionally disabled the SHA or enforcement client during troubleshooting or rollout.
- A product upgrade preserved registration but left its enabled flag off after migration.
- The component was disabled after repeated failures and the operational workflow never re-enabled it.
- Local configuration and domain policy disagree, causing management tools to display an unexpected effective state.
- Automation targets the wrong entity ID and encounters another component that is legitimately disabled.
Configuration evidence
- Capture the entity ID, category, friendly name, registration owner, and effective enabled state.
- Record local management changes, Group Policy refresh time, and the tool or API that last modified the component.
- Verify NapAgent is running and the component is registered so the disabled state is not inferred from unrelated failures.
- Correlate the state with expected policy: some legacy deployments intentionally disabled unused enforcement clients.
Restoring intentional state
- Identify the authoritative configuration source before changing the local setting.
- Confirm the component binary and registration are healthy enough to re-enter service.
- Enable the exact entity through supported NAP management, then trigger a fresh SoH exchange.
- Observe callbacks and isolation results after enablement; a successful state change does not validate the component implementation.
Difference from nearby NAP results
NAP_E_NOT_REGISTERED means no registration exists. NAP_E_SERVICE_NOT_RUNNING means the broker service is unavailable. NAP_E_NETSH_GROUPPOLICY_ERROR indicates that a group-policy-dependent command has no applicable policy configuration. This code specifically identifies the entity’s disabled state inside NapAgent.
Retry and recovery
Retrying the rejected operation without changing effective configuration is deterministic. Enable the component only when policy and platform support require it; on modern Windows, NAP is unavailable and should not be resurrected. If policy immediately disables the entity again, fix the policy source rather than repeatedly toggling local state.
Practical scenario
A legacy VPN enforcement client remains registered after a maintenance window, but an administrator disabled it to isolate a crash. The service later tries to bind and receives NAP_E_ENTITY_DISABLED. After the fixed binary is deployed, the administrator re-enables that exact ID and verifies a new health exchange.
References
- Microsoft: NAP error constants
- Microsoft: Network Access Protection
- Microsoft: NAP client architecture
- Microsoft: NAP interfaces
Looking for a different code? Search another status or error code.