HRESULT 0x8031009D (FVE_E_MULTIPLE_NKP

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

BitLocker Network Unlock found multiple candidate certificates and cannot choose one.

Previous	Next
FVE_E_EFI_ONLY	FVE_E_REMOVAL_OF_NKP_FAILED

FVE_E_MULTIPLE_NKP_CERTS

Network Unlock requires one unambiguous certificate

FVE_E_MULTIPLE_NKP_CERTS means the local certificate store contains more than one certificate that qualifies as a BitLocker Network Unlock certificate. The client cannot safely infer which public key corresponds to the WDS Network Unlock provider.

Selection must be based on certificate purpose and deployment identity, not just a matching subject name. Old, renewed, and test certificates can coexist after rollovers and create ambiguity even when each certificate is individually valid.

What to compare

Thumbprint, serial number, validity period, EKU OID, Key Usage, and issuing chain for every candidate.
The certificate deployed through Group Policy to clients versus the certificate and private key installed on the WDS server.
Whether a renewal left an obsolete certificate in the BitLocker Network Unlock certificate store.
Remove only the unintended candidate after confirming which certificate protects currently deployed clients.

References

Looking for a different code? Search another status or error code.