| Previous | Next |
| UTC_E_ESCALATION_NOT_AUTHORIZED | UTC_E_CHILD_PROCESS_FAILED |
UTC_E_SETUP_NOT_AUTHORIZED
Locate the rejected contract: scenario setup authorization
UTC_E_SETUP_NOT_AUTHORIZED has the unsigned value 0x87C5101C. In UTC it comes from policy and trust enforcement, where scenario setup authorization owns the decision. The symbolic name points to a narrow UTC contract that can be tested directly for this HRESULT. The immediate contract failed because the preparatory setup actions were rejected by UTC policy or caller permissions, so diagnosis should remain at that boundary until a controlled comparison crosses it for this HRESULT.
DiagTrack applies allowlists, signer checks, path restrictions and destination-specific collection policy for this HRESULT. These gates are intended security/privacy boundaries. Diagnosis should identify the exact denied capability rather than recommending broad privilege or policy changes for this HRESULT. Record the configuration package or scenario generation together with the Windows build; otherwise a repaired file can be tested against a stale in-memory graph and appear to fail for the same reason for this HRESULT.
Capture checklist
| UTC diagnostic field | Value |
|---|---|
| Owning state or object | scenario setup authorization |
| Producing layer | policy and trust enforcement |
| Do not confuse with | UTC_E_ESCALATION_NOT_AUTHORIZED occurs later, when the escalation itself is denied |
| Decisive evidence | setup action list, caller token, scenario signature, target paths/services and policy decision |
| Narrow comparison | remove one setup action at a time in a signed test scenario to identify the denied capability |
The AllStat message names the immediate condition as “Setup for scenario failed due to insufficient permissions” for this HRESULT. In practice, the useful extension is to ask whether the request was rejected before any side effect, after partial setup, or during cleanup for this HRESULT. Verify the existence and ownership of the expected output—session, directory, process, result object or emitted event—rather than assuming the message describes the final system state for this HRESULT.
Comparison with a passing case
- Export the relevant
Microsoft-Windows-UniversalTelemetryClient/Operationalevents and preserve their ActivityId or request correlation alongside this result. - Capture setup action list, caller token, scenario signature, target paths/services and policy decision for this HRESULT. Do this before restarting the service or deleting any working directory for this HRESULT.
- Perform this one-variable comparison: remove one setup action at a time in a signed test scenario to identify the denied capability for this HRESULT.
- After the comparison, record the next HRESULT and whether the requested session, action, trigger or output object was actually created for this HRESULT.
The most informative neighbor is UTC_E_ESCALATION_NOT_AUTHORIZED. The distinction is concrete: UTC_E_ESCALATION_NOT_AUTHORIZED occurs later, when the escalation itself is denied for this HRESULT. Keeping both symbolic names in logs prevents a broad “DiagTrack error” bucket from hiding whether the failure occurred during parsing, authorization, resource acquisition, execution or teardown for this HRESULT.
Policy-preserving test
Build the passing case for this HRESULT with an approved path, signer, command or certificate while keeping the enforcement mechanism enabled for this HRESULT. This demonstrates compliance with the policy boundary rather than merely removing the boundary for this HRESULT.
Resolution and regression test
Correct the setup contract or execution identity before evaluating any escalation result for this HRESULT. Apply that change only to the owning boundary for this HRESULT. A successful repair must make the controlled case cross this boundary while retaining the intended policy, trace providers, destination and security context for this HRESULT.
Deleting the working directory, killing all ETW sessions or retrying in a tight loop can suppress this result temporarily while leaving the underlying lifecycle defect intact for this HRESULT.
- the same request now produces its documented success or nonfatal status without a second hidden retry
- the operational log shows one coherent request lifetime and no orphaned action, timer, process or trace session
- teardown followed by a second run does not reuse stale state or recreate scenario setup authorization
- the nearby condition remains distinguishable: UTC_E_ESCALATION_NOT_AUTHORIZED occurs later, when the escalation itself is denied
Technical references
- Microsoft Open Specifications: Windows error-code registry — reference for policy and trust enforcement while interpreting this result.
- Microsoft: Universal Telemetry Client configuration diagnosis — reference for policy and trust enforcement while interpreting this result.
- Microsoft: CertVerifyCertificateChainPolicy — reference for policy and trust enforcement while interpreting it.
- Microsoft: Windows cryptography functions
Looking for a different code? Search another status or error code.