What does HRESULT 0x87C5102E (UTC_E_GETFILE_FILE_PATH_NOT_APPROVED) mean?

UTC_E_GETFILE_FILE_PATH_NOT_APPROVED

Read this as a lifecycle result: GetFile collection path policy

When UTC_E_GETFILE_FILE_PATH_NOT_APPROVED (0x87C5102E) is returned, the producing layer is policy and trust enforcement. Treat this HRESULT as a state-machine report, not as a generic telemetry outage. The rejected object or state is GetFile collection path policy, and the specific condition is that a local path requested by GetFile is outside the approved collection roots or fails canonical path checks. Keep this first HRESULT even if a later service call reports another error.

DiagTrack applies allowlists, signer checks, path restrictions and destination-specific collection policy. These gates are intended security/privacy boundaries. Diagnosis should identify the exact denied capability rather than recommending broad privilege or policy changes.

Diagnostic record

Isolate one changing condition

1. Export the relevant Microsoft-Windows-UniversalTelemetryClient/Operational events and preserve their ActivityId or request correlation alongside this result.
2. Capture original and canonical path, environment expansion, reparse points, file owner, scenario signer and policy rule. Do this before restarting the service or deleting any working directory.
3. Perform this one-variable comparison: collect a small test file from an approved root using the same action.
4. After the comparison, record the next HRESULT and whether the requested session, action, trigger or output object was actually created.

Nearby result: UTC_E_GETFILE_EXTERNAL_PATH_NOT_APPROVED — adds stricter rules for external-ring collection.

Policy-preserving test

Build the passing case with an approved path, signer, command or certificate while keeping the enforcement mechanism enabled. This demonstrates compliance with the policy boundary rather than merely removing the boundary.

Operational response

Move diagnostic output to an approved location or change the signed scenario policy; avoid traversal or symlink tricks.

Technical references

• Microsoft Open Specifications: Windows error-code registry — reference for policy and trust enforcement while interpreting this result.
• Microsoft: Universal Telemetry Client configuration diagnosis
• Microsoft: CertVerifyCertificateChainPolicy
• Microsoft: Windows cryptography functions