| Previous | Next |
| STATUS_PCP_NOT_PCR_BOUND | STATUS_PCP_KEY_USAGE_POLICY_NOT_SUPPORTED |
STATUS_PCP_KEY_ALREADY_FINALIZED
The caller repeated a setup step after key finalization
STATUS_PCP_KEY_ALREADY_FINALIZED is the mirror image of key-not-finalized. The key has already completed the stage at which creation-time configuration is accepted, so a caller is attempting an operation that belongs earlier in the lifecycle.
This is often caused by duplicate initialization, racing setup code, or treating a persisted key as if every open returned a new mutable key. It is not a signal to call finalization again or to overwrite an existing key automatically.
What to check
- Audit whether the key was opened as an existing persisted key or created as a new one, and track which code path owns finalization.
- Separate mutable runtime properties from creation-only settings in application logic.
- For a configuration change that truly requires a new key, follow the product's rotation and enrollment design so dependent certificates or policies remain consistent.
References
- Microsoft: PCP and TPM error codes
- Microsoft: NCryptCreatePersistedKey
- Microsoft: CNG Key Storage Providers
Looking for a different code? Search another status or error code.