What does NTSTATUS 0xC00004A3 (STATUS_FILE_PROTECTED_UNDER_DPL) mean?

 
Previous Next
STATUS_ENCLAVE_VIOLATION STATUS_VOLUME_NOT_CLUSTER_ALIGNED

STATUS_FILE_PROTECTED_UNDER_DPL

DPL deliberately removes access to protected data while the device is locked

STATUS_FILE_PROTECTED_UNDER_DPL is a data-protection state, not an ordinary file ACL denial. Microsoft documents Data Protection under Lock (DPL) in the Windows Information Protection developer model. With secure DPL policy configured, Windows removes data-protection encryption keys from device memory when the device is locked and removes keys associated with protected files when their handles close.

That lifecycle explains why the same file can be accessible before lock, become unavailable while protected under DPL, and work again after the device is unlocked and protection state resumes. Applications handling protected data can receive protection-suspending and resumed events. A service or background task that assumes every open/read failure is permanent can therefore mishandle a deliberate temporary protection boundary.

Record device lock state, WIP/DPL policy, file protection status, application identity, and whether a protected handle was closed during lock. Correlate the failure with suspend/resume protection events. Do not change NTFS ACLs or take ownership as a first response: ACL changes do not restore encryption keys removed by DPL policy. The application should follow the documented protection lifecycle and defer protected-file work until access resumes when its design permits that behavior.

What to inspect

  • Correlate the status with device lock/unlock and protection suspend/resume events.
  • Identify whether the file is enterprise-protected and whether its handle was closed while the device was locked.
  • Do not diagnose DPL as a normal ACL problem; inspect key/protection lifecycle before changing permissions.

References

Looking for a different code? Search another status or error code.