What does HRESULT 0x8004170B (FILTER_E_PASSWORD) mean?

FILTER_E_PASSWORD

Password protection prevents document filtering

FILTER_E_PASSWORD is HRESULT 0x8004170B. Windows documents it as “File was not filtered due to password protection.”

State represented by the HRESULT

This result belongs to opening encrypted or password-protected content before chunks can be extracted. The filter cannot obtain clear document content with the credentials and APIs available to the indexing host.

Likely triggers

• At step 1, the document requires an open password
• At step 2, rights-management policy denies the service identity
• At step 3, a saved credential is absent or expired
• At step 4, the filter deliberately refuses interactive password prompts

Compare the failing case with a control that preserves document protection type without recording secrets and changes only filter handler and version; this prevents unrelated environment differences from dominating the test.

Data for diagnosis

• Document protection type without recording secrets.
• Filter handler and version.
• Identity of the noninteractive host.
• Whether metadata was available before decryption.

Capture document protection type without recording secrets before releasing objects, closing handles or reconnecting. Retain the raw HRESULT with filter handler and version, component version, UTC timestamp and correlation ID.

Investigation order

1. Confirm the file is actually protected using its owning application.
2. Determine whether the filter supports noninteractive decryption.
3. Check enterprise rights and key availability for the service identity.
4. Classify already emitted metadata separately from protected body text.

Preserve the component version and target identity, then alter only the condition described as the filter cannot obtain clear document content with the credentials and APIs available to the indexing host.

Correct response

Supply content through an approved decrypted workflow or grant the intended service identity access. Do not log or repeatedly guess passwords. Record whether opening encrypted or password-protected content before chunks can be extracted produced any content, update or state transition before returning.

Retry only after a concrete change in document protection type without recording secrets or filter handler and version.

Scope of the signal

It does not establish that the password is wrong; no credential may have been offered at all. Without the call boundary for opening encrypted or password-protected content before chunks can be extracted, it also cannot identify which wrapper or configuration layer introduced the condition.

Related HRESULT values

FILTER_E_ACCESS is a broader access failure, whereas it identifies document protection as the barrier.

Developer and administrator actions

• Record document protection type without recording secrets with the returned HRESULT.
• In telemetry, correlate filter handler and version with the target and component generation.
• For regression coverage, force the documented condition: the filter cannot obtain clear document content with the credentials and APIs available to the indexing host.

Example in a pipeline

A crawler receives searchable filenames but no body text from encrypted Office documents. A controlled ingestion path decrypts approved files before indexing.

Official Microsoft references

• Microsoft: Filter-Interface values — official contract information relevant to this HRESULT.
• Microsoft: filter handlers in Windows Search
• Microsoft: IFilter interface
• Microsoft: testing filter handlers