| Previous | Next |
| MF_E_GRL_EXTENSIBLE_ENTRY_NOT_FOUND | MF_E_PEAUTH_UNTRUSTED |
MF_E_KERNEL_UNTRUSTED
MF_E_KERNEL_UNTRUSTED is a high-security protected-content trust result. Protected Media Path does not validate only user-mode decoders: the protected environment threat model also includes kernel-mode components and drivers that can affect protected media.
Diagnose kernel trust separately from codec support
- Capture the protected-content security level and the first PE/PEAuth trust HRESULT.
- Record recently installed or changed kernel drivers relevant to graphics, audio, capture, or media protection.
- When revocation details are exposed, check whether the failure is marked as a kernel-mode component load; the documented revocation structure distinguishes kernel-mode and user-mode component failures.
A successful unprotected playback test does not disprove this problem. The same codec may work in a normal Media Session while high-security content requires a protected environment with stronger trust checks. Focus on system trust and serviced drivers rather than trying arbitrary decoder merit changes.
Microsoft: Protected Environment threat model · Microsoft: kernel-mode revocation information · Microsoft: protected process constraints
Looking for a different code? Search another status or error code.