| Previous | Next |
| NTE_VALIDATION_FAILED | NTE_ENCRYPTION_FAILURE |
NTE_INCORRECT_PASSWORD
The important part of NTE_INCORRECT_PASSWORD is its scope: provider credential rejection. The provider evaluated the supplied password, PIN, or protected-key credential and determined that it does not unlock the requested key or token state. Keep the hexadecimal value 0x80090033 with the returning API, because higher-level software may translate it into a message that loses this distinction.
Start with the returning API
Protected providers can distinguish a wrong secret, an expired secret that must be changed, and a mitigation state in which new attempts are ignored., preserve attempt timing and provider state; otherwise all three can be flattened into a generic PIN or password failure by the application.
Diagnostic evidence matrix
- 1. Provider and device identity, credential type, attempt count, lockout or throttling state, and timestamps
Confirm which credential the provider expects; account passwords, PFX passwords, token PINs, and key-protection passwords are not interchangeable. - 2. Whether the secret was rejected, accepted but expired, or not evaluated
Avoid logging the secret while still recording credential source, key name, provider, and attempt count. - 3. The supported password-change or unblock workflow for the specific provider
Check lockout policy before retrying and prompt once through the provider-approved UI.
For provider credential rejection, these observations are deliberately nonsecret: identifiers, lengths, provider names, policy selections, and state transitions usually support comparison without recording private keys, passwords, PINs, or plaintext.
What to include in an escalation package
Correlate the last successful operation with provider installation or update, key creation or renewal, profile or session changes, device insertion and removal, policy refresh, and the first failing call. The order matters: a provider error that starts immediately after a key migration suggests a different boundary from one that appears only after a service account changes.
- a minimal reproducer that names the API, provider, key or container, flags, and nonsecret input sizes.
- In the path, provider, device, profile, and operating-system event records covering the last success and first failure.
- In the path, a known-good control result produced under the same identity, architecture, and provider selection.
Minimal test sequence
In the path, stop automated retries. After the provider-defined cooldown or administrative recovery, make one labeled attempt with a known valid test credential on a nonproduction object in a provider credential rejection investigation. For expiry, use the supported change workflow rather than repeatedly presenting the old value.
- Preserve the original input, identity, provider or protocol selection, and first return Value.
- Use one known-good control that changes only the suspected part of the provider credential rejection path.
- reverse the comparison with known-good input on the failing layer where that can be done safely.
- Record where behavior first diverges in the provider credential rejection path instead of judging only by the final application message.
Boundaries of this HRESULT
NTE_AUTHENTICATION_IGNORED means mitigation prevented normal evaluation; this code means an actual credential check failed. Do not infer that credentials are wrong when the provider says they were ignored, and do not clear the state by resetting the token before recording lockout evidence in a provider credential rejection investigation.
For provider credential rejection, also retain the original numeric value; neighboring constants can encode materially different remediation paths even when an application presents all of them as an authentication, certificate, or security failure.
Closure criteria
In the path, the provider must evaluate the credential normally, enforce its retry policy, and complete the protected operation after any required change or recovery procedure. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.
Technical references
These sources define the HRESULT and the relevant provider credential rejection interface, protocol, or data format.
- Microsoft Open Specifications: HRESULT values.
- Microsoft: CNG Key Storage Providers.
- Microsoft: CNG key storage functions.
Looking for a different code? Search another status or error code.