| Previous | Next |
| NTE_NOT_SUPPORTED | NTE_BUFFERS_OVERLAP |
NTE_NO_MORE_ITEMS
The important part of NTE_NO_MORE_ITEMS is its scope: provider enumeration. An enumeration reached its normal end, so the next provider, key, algorithm, or property entry does not exist in the current enumeration state. Keep the hexadecimal value 0x8009002A with the returning API, because higher-level software may translate it into a message that loses this distinction.
What the code establishes
Provider and key enumeration APIs commonly use a continuation state and return an end-of-sequence status after the final item. Interpret the call position: the same value can be a normal loop terminator after successful entries or evidence that the selected scope contained no visible entries from the beginning.
Facts to preserve before changing state
- 1. Provider, scope, flags, and identity used to start enumeration
Treat the status as termination when it follows successful enumeration calls. - 2. Every successful item and the continuation-state lifetime
Release the enumeration state with the matching API and avoid reusing it after provider changes. - 3. Whether the caller treats end-of-sequence as completion or as a retryable failure
If zero items were unexpected, verify scope, provider name, flags, and the identity whose keys are being enumerated.
For provider enumeration, these observations are deliberately nonsecret: identifiers, lengths, provider names, policy selections, and state transitions usually support comparison without recording private keys, passwords, PINs, or plaintext.
Correlate the failure with state changes
Correlate the last successful operation with provider installation or update, key creation or renewal, profile or session changes, device insertion and removal, policy refresh, and the first failing call. The order matters: a provider error that starts immediately after a key migration suggests a different boundary from one that appears only after a service account changes.
- a minimal reproducer that names the API, provider, key or container, flags, and nonsecret input sizes.
- In the path, provider, device, profile, and operating-system event records covering the last success and first failure.
- In the path, a known-good control result produced under the same identity, architecture, and provider selection.
Isolation procedure
In the path, run the same enumeration under the intended identity against a provider with one known test key. Confirm that the loop reports the item once, reaches the terminal status once, and releases the state in a provider enumeration investigation. This catches restart loops and stale continuation data.
| Test | Interpretation |
|---|---|
| Same input, known-good path | For provider enumeration, success moves attention toward the selected provider, policy, device, context, or transaction state. |
| Known-good input, failing path | For provider enumeration, failure suggests that the environment or selected object is independently unable to perform the operation. |
| Original path after one isolated change | For provider enumeration, this comparison demonstrates whether the proposed correction addresses the original condition. |
Common wrong turns
This status can be a normal loop condition rather than a fault. It should not be converted into a retry storm. Do not retry the terminal call without resetting enumeration state. That can create a busy loop while returning no additional information.
For provider enumeration, also retain the original numeric value; neighboring constants can encode materially different remediation paths even when an application presents all of them as an authentication, certificate, or security failure.
Proving the intended path works
The caller should distinguish an expected terminal status from an unexpectedly empty result and should release enumeration resources on both paths in a provider enumeration investigation. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.
Technical references
These sources define the HRESULT and the relevant provider enumeration interface, protocol, or data format.
- Microsoft Open Specifications: HRESULT values.
- Microsoft: CNG Key Storage Providers.
- Microsoft: CNG key storage functions.
Looking for a different code? Search another status or error code.