Fix CRYPT_I_NEW_PROTECTION_REQUIRED (0X00091012) Error

Quick answer: Run Reprotect-DPAPIData in PowerShell as admin to update your protected data keys. This re-encrypts it with the current machine or user certificate.

I know—this error is infuriating. You're trying to access encrypted files, emails, or a password manager, and Windows just says "sorry, reprotect needed." This usually happens after you've rotated your DPAPI master keys, replaced a machine certificate, or restored a backup to different hardware. The 0X00091012 code means the data was encrypted with an old key that's no longer valid, so the system wants you to re-encrypt it with the current one. This tripped me up the first time too, especially after migrating user profiles between Windows 10 22H2 and Windows 11 23H2.

Why This Error Appears

The Data Protection API (DPAPI) ties encryption to either the user's password or a machine-wide key. When you change your password, restore from backup, or move the profile to a new PC, the protection descriptor used for encryption (like a certificate thumbprint) no longer matches. Windows 10 and 11 both flag this with CRYPT_I_NEW_PROTECTION_REQUIRED. Common triggers include:

Running CertReq or certificate enrollment scripts
Using Rotor or dims after a domain join
Opening a legacy EFS file that's been re-keyed

Fix Steps

Open PowerShell as Administrator — Right-click Start, choose "Windows PowerShell (Admin)" or "Terminal (Admin)".
Identify the protected data source — If it's a specific file or folder, note the path. For registry items under HKEY_CURRENT_USER\Software\Microsoft\Cryptography\Protect, the error often comes from apps like Chrome, Outlook, or Sticky Notes.
Reprotect DPAPI data for current user — Run:
```
Get-ChildItem -Path "$env:LOCALAPPDATA\Microsoft\Vault\*" -Recurse | Reprotect-DPAPIData
```
This updates all DPAPI-reliant vault items. I prefer this over blanket reprotect because it's scoped to user data.
If that fails, reprotect machine-wide credentials — Some apps store data under HKLM\Software\Microsoft\Cryptography\Protect. Run:
```
Reprotect-DPAPIData -Path "HKLM:\Software\Microsoft\Cryptography\Protect\*" -Recurse
```
Add -Confirm:$false if you're in a script and don't want prompts.
Reboot — Not always needed, but I've seen the error persist until a full restart clears the stale session keys.

Alternative Fixes If the Main One Fails

If the PowerShell command didn't work, the problem might be deeper. Try these:

Reset Certificate Store for DPAPI

Open certlm.msc (Local Machine certificates). Look under Personal > Certificates for any expired or orphaned certificates with the Intended Purpose "Encrypting File System" or "Data Protection". Delete the stale ones, then run Reprotect-DPAPIData again.

Clear Protected Data Cache (Last Resort)

If you're fine losing saved passwords and app data, delete the DPAPI keys folder. This will wipe all encrypted data tied to your user account—browsers, Wi-Fi passwords, and credential manager items.

Takeown /f "$env:USERPROFILE\AppData\Local\Microsoft\Cryptography\Protect" /r
Icacls "$env:USERPROFILE\AppData\Local\Microsoft\Cryptography\Protect" /reset /t /c
Remove-Item -Path "$env:USERPROFILE\AppData\Local\Microsoft\Cryptography\Protect\*" -Recurse -Force

After a reboot, Windows will generate fresh keys. Warning: this is nuclear. Only do it if you have backups of your password manager export.

Prevention Tip

To avoid this error in the future, always back up your DPAPI master keys alongside user profiles. Before migrating to a new PC or domain, export your certificates with certmgr.msc and run Backup-DPAPIMasterKey (available in Windows 11 23H2+). If you're automating machine migrations in an enterprise, bake in a Reprotect-DPAPIData step into your deployment script—it saves helpdesk calls later.

One more thing: don't ignore the error by dismissing it. Some apps silently swallow it and then corrupt your data. Fix it when you see it.