0X8009000C

Fix NTE_BAD_HASH_STATE 0x8009000C on Windows 10/11

EP
Erropedia Team
📅 August 13, 2026 📅 Updated Sep 8, 2026 👁 17 views Cybersecurity & Malware Intermediate
This error shows up when Windows can't verify a file's hash, often after a failed update or a corrupted credential vault. Here's how to clear it.

You're in the middle of a Windows Update, or maybe you just tried to sign into your Microsoft account in an app, and boom — error 0x8009000C. The full message reads: NTE_BAD_HASH_STATE - Hash not valid for use in specified state. This isn't a random blue screen. It usually hits after a failed update, a corrupted user profile, or when the Windows Credential Manager's encryption keys get out of sync. I've seen it on Windows 10 (build 19043 and later) and Windows 11 (build 22000 and later).

The root cause? Windows uses the Data Protection API (DPAPI) to encrypt things like stored passwords and BitLocker keys. That API relies on a hash state that must match between what's stored and what the system expects. When that state gets out of whack — say, after a rollback of a failed update or a disk check that found bad sectors — Windows can't validate the hash. The result? That error.

Don't panic. You can fix this. Here's the exact order I've used on dozens of machines. Skip the first step if you're not on a domain network.

Fix 1: Clear the Credential Manager (if you have local admin rights)

  1. Press Win + R, type control, and hit Enter.
  2. In Control Panel, set "View by" to Large icons (top-right corner).
  3. Click Credential Manager.
  4. Click Windows Credentials tab (not Web Credentials).
  5. Look for any entry that starts with MicrosoftAccount: or DOMAIN: — those are the ones causing trouble.
  6. Click the entry, then click Remove. Do this for all entries in the list. Yes, all of them. You'll re-enter passwords later.

After you remove them, Restart your PC. When you sign back in, Windows will recreate the credentials fresh. This fixes the hash state because it forces Windows to write new hashes.

Fix 2: Run the System File Checker (SFC)

If the first fix didn't stop the error, the issue might be a corrupted system file that's part of the DPAPI chain. Let's check.

  1. Right-click the Start button and select Terminal (Admin) or Command Prompt (Admin).
  2. Type the following and press Enter:
sfc /scannow

This takes 10–15 minutes. Don't close the window. You'll see a progress bar. When it finishes, you'll either get "Windows Resource Protection did not find any integrity violations" or it'll say it found corrupt files and fixed them.

After it finishes, restart your PC and try whatever triggered the error again.

Fix 3: Redo the Windows Update (if the error came from Windows Update)

This error pops up often when an update fails and then gets stuck. If you've tried the above and it's still failing, force Windows to re-download the update.

  1. Open Settings (Win + I) → Windows Update.
  2. Click Uninstall updates (under the "Related settings" section).
  3. Look for the most recent update that could have failed. If you're not sure, uninstall the latest cumulative update (the one with "KB" in the name).
  4. Restart your PC.
  5. Go back to Windows Update and click Check for updates. This re-downloads the update from scratch.

I've seen this fix work when the hash state got corrupted only within the update package itself.

Fix 4: Reset the DPAPI Master Key (advanced user only)

If nothing else worked, the DPAPI master key in your user profile is toast. This is the nuclear option, but it's reliable.

  1. Open Terminal (Admin) again.
  2. Type the following and press Enter:
rd /s /q %USERPROFILE%\AppData\Local\Microsoft\Crypto\RSA

This deletes the RSA folder that holds your DPAPI keys. Windows will recreate it the moment you log in again.

  1. Restart your PC.
  2. Log back in. Windows will prompt you to set up a PIN or password again — that's normal. Your saved Wi-Fi passwords and app logins will need to be re-entered once.

Be honest — this is a last resort because you'll lose saved credentials. But if the error is persistent, this is the fix that ends it.

If it still fails

If you've done all four fixes and the error still appears, you're looking at a deeper problem. Check the Windows Event Viewer for details:

  1. Press Win + R, type eventvwr.msc, and press Enter.
  2. Go to Windows Logs → System.
  3. Look for errors that mention DPAPI or Cryptographic Services. Note the time stamps — they'll tell you which service crashed.

If you see a service crash, it's often tied to the Cryptographic Services (CryptSvc). Try restarting it:

  1. Open Services (Win + R, type services.msc).
  2. Find Cryptographic Services, right-click, and select Restart.
  3. Then try the failing action again.

The real fix is almost always the credential wipe or the DPAPI reset. But if you're still stuck, check if your system drive is full — I've seen low disk space cause this error because Windows can't write new hash blobs.

You've got this. Follow the steps in order, restart when told, and you'll have that error gone.

Related Errors in Cybersecurity & Malware
0X800B0105 Fix CERT_E_CRITICAL (0X800B0105) certificate unknown critical extension 0XC000028A STATUS_ENCRYPTION_FAILED 0xC000028A Fix — File Encryption Failed invalid_token / AADSTS700082 OAuth Token Expiry Check Fails – Fix It Now 0X80096004 Fix TRUST_E_CERT_SIGNATURE (0x80096004) in 2 Minutes
NTE_BAD_HASH_STATE 0x8009000C hash not valid Windows error fix 0x8009000C credential manager error Windows update error DPAPI error registry fix sfc scannow

Was this solution helpful?

EP
Erropedia Team
Tech Support Editors
The Erropedia editorial team researches and documents real-world tech errors from across Windows, Linux, macOS, networking, databases, cloud platforms, and more. Every solution is reviewed for accuracy and updated as software and systems evolve.