| Previous | Next |
| FVE_E_REMOVAL_OF_NKP_FAILED | FVE_E_NO_EXISTING_PIN |
FVE_E_INVALID_NKP_CERT
A Network Unlock certificate has a narrow profile
FVE_E_INVALID_NKP_CERT means a candidate certificate was found in the Network Key Protector store but cannot be used for Network Unlock. Microsoft’s deployment procedure specifies a machine certificate with the BitLocker Network Unlock OID, key-encipherment usage, an appropriate RSA key, and a private key on the WDS server.
A trusted chain alone is not sufficient. The wrong EKU, absent private key, unsuitable key provider, expired certificate, or mismatch between the client-deployed public certificate and the server certificate can all break the protector workflow.
What to inspect
- Validate EKU
1.3.6.1.4.1.311.67.1.1, Key Usage, key size, validity, and thumbprint. - Confirm that WDS has the private key while clients receive only the intended public certificate through policy.
- Check that the certificate is in the documented local-machine stores rather than only a user store.
- Recreate or re-enroll the certificate from a controlled template instead of modifying extensions after issuance.
References
- Microsoft: BitLocker Network Unlock certificate creation
- Microsoft: Network Unlock known issues
- RFC 5280: X.509 certificate profile
Looking for a different code? Search another status or error code.