What does HRESULT 0xC00D2719 (NS_E_DRM_INVALID_MACHINE) mean?

NS_E_DRM_INVALID_MACHINE

How to classify this result

When the client returns NS_E_DRM_INVALID_MACHINE (0xC00D2719), the relevant condition is the protected license state is bound to a different machine identity. This result belongs to local license store, secure store and machine binding, specifically the protected repositories that hold licenses and DRM state, together with the hardware and checkpoint data used to bind that state to one installation.

Compare machine-binding evidence and the supported backup or migration history.

Minimum incident record

• Code-specific proof: compare machine-binding evidence and the supported backup or migration history.
• Protected identity: checkpoint, secure-store and registry persistence sequence.
• Operation state: first store API call that failed: open, enumerate, save, close or query.
• Persistence or transport: license identifier and content key identifier (KID).
• Security context: store path, file generation, access result and underlying system error.
• Correlation point: hardware identity and the last hardware or operating-system change.

For the “invalid machine” investigation, use KIDs, license IDs, hashes, certificate thumbprints, sizes and timestamps where possible. Do not place content keys, complete license blobs, passwords, cookies or decrypted media in ordinary logs.

Why the producing layer matters

Two platform rules frame this result. A license is stored in the protected local license store after acquisition; a store failure is therefore distinct from a server refusing to issue a license.

Triage without destroying evidence

1. Locate the earliest API return, callback or event containing this result and 0xC00D2719.
2. Identify the exact content, license, store, device or migration object instance involved in “invalid machine”.
3. Determine whether “invalid machine” occurred before network exchange, during response validation, while enforcing policy, or while committing protected state.
4. Perform the code-specific check: compare machine-binding evidence and the supported backup or migration history.
5. Make one targeted change — use supported backup/restore, migration or reacquisition instead of file copying — and repeat the same producing operation.

Why the symbolic name matters

Several values can accompany the “invalid machine” condition in one incident. Order the event chain by timestamp and prefer the first code produced at the lowest specific boundary over a later player-level summary.

Shortcuts that make diagnosis worse

• Avoid copying a protected license store from another computer as a repair.
• Avoid deleting or resetting DRM state before recording hashes, timestamps and the first store error.

Recovery at the right layer

To correct this, use supported backup/restore, migration or reacquisition instead of file copying. Preserve the original content/header, store or migration material until the “invalid machine” operation succeeds and survives a fresh application object or required restart.

Representative case: License-store files copied from another PC are readable but not valid on the target.

Completion criteria

After the repair, recreate the WMDRM object and run the smallest reproducer. Confirm that 0xC00D2719 no longer occurs, that the intended license action completes, and that no store, certificate, clock or migration warning replaces it.

Code-specific operational note

The user-facing message “Licenses cannot be copied from one computer to another. Use License Management to transfer licenses, or get a new license for the media file.” describes the visible condition but does not identify the producing API, object instance, or protected identity by itself.

Technical references

• Licenses and the local license store — API and state rules for the DRM operation described here.
• Enumerating licenses in the local store.
• DRM client interfaces.
• Windows Media DRM error codes — API and state rules for the DRM operation described here.