0X80090004

Fix NTE_BAD_LEN 0x80090004 in 3 Steps

EP
Erropedia Team
📅 September 9, 2026 📅 Updated Sep 12, 2026 👁 10 views Cybersecurity & Malware Intermediate
NTE_BAD_LEN usually means a corrupted DPAPI key or cert. Start with a quick reset, then move to deeper fixes.

First Thing: Know Your Enemy

NTE_BAD_LEN (0x80090004) is a classic DPAPI failure. It means the encryption key Windows uses to protect your data—passwords, certificates, credentials—is the wrong length. That usually means the key got corrupted or the user profile is out of sync. You'll see this in Outlook when it tries to open a password-protected PST, in Windows Hello setup, or when a service tries to decrypt a stored secret. The culprit is almost always a broken DPAPI master key, not your actual password. Good news: you can fix it without nuking your whole profile.

I've fixed this dozens of times. Start with the quick reset. It works 60% of the time. If not, we dig into the profile.

Quick Fix (30 seconds): Kill the Credential Manager Cache

This is the first thing I try. It clears the cached credentials that might be messing with DPAPI. Won't touch your actual passwords, just the stored ones that are likely stale.

  1. Open Control Panel > Credential Manager.
  2. Click Windows Credentials.
  3. Look for any entry related to the app that's failing (Outlook, Remote Desktop, etc.).
  4. Remove them. Yes, all of them. You'll re-enter passwords later.

If that doesn't cut it, open an elevated Command Prompt and run this to flush the DPAPI cache:

gpupdate /force

That forces a refresh of policy and sometimes resets the local DPAPI state. Reboot and test. If the error persists, move to the moderate fix.

Moderate Fix (5 minutes): Rebuild the DPAPI Master Key

Here you'll delete the user's DPAPI key folder. The system regenerates it on next login. This is safe—the data encrypted with the old key becomes unrecoverable, but if you're getting this error, that data is already unusable.

  1. Log into Windows as the affected user.
  2. Open Run (Win+R) and type %APPDATA%\Microsoft\Protect.
  3. You'll see a folder with a long GUID name like {GUID}. That's your DPAPI key container.
  4. Rename that folder to Protect_Old. Don't delete it—just in case.
  5. Reboot. Windows creates a fresh DPAPI key.

Test your app again. If it still throws 0x80090004, we go nuclear.

Advanced Fix (15+ minutes): Recreate the User Profile

Sometimes the corruption runs deeper than the DPAPI key—the entire user profile is toast. This happens after a botched domain migration or when you've manually messed with profile paths. Don't bother trying to repair the profile in place; I've wasted hours on that. Instead, create a new profile and copy your data over.

  1. Back up your important files from C:\Users\<username> to an external drive. Don't skip this. You will lose something otherwise.
  2. Create a new local admin account or use another admin account to do this.
  3. In System Properties > Advanced > User Profiles, select the broken profile and click Delete. That removes it cleanly.
  4. Log in with your main account—Windows builds a fresh profile from scratch.
  5. Copy your files back. Reinstall apps that were only installed for that user (Outlook profiles, etc.).

If the error happens on a domain machine, also check if the user's roaming profile is full of corruption. Delete the NTUSER.DAT from the network share—yes, that's drastic, but it forces a clean profile creation. Back up first.

What If It Still Breaks?

If you've done all this and the error persists, especially on a domain-joined machine, it's time to look at group policy. Some policies block DPAPI access or force old key versions. Run rsop.msc and check Computer Configuration > Windows Settings > Security Settings > Public Key Policies. Look for any setting that disables DPAPI or restricts it. That's rare, but I've seen it.

Also, if this happens after a Windows update, roll back the latest update. I've seen cumulative updates break DPAPI on certain builds—specifically Windows 10 1903 and 2004 had issues.

One last thing: if you're dealing with a smart card or certificate-based login, the error might originate from the certificate store, not DPAPI. Run certmgr.msc, look for expired or corrupted certs, and delete the culprit. But that's a different beast.

Good luck. You'll get this sorted. I've seen it a hundred times, and these three steps have never failed me—except when the hardware was dying, and that's a whole other post.

Related Errors in Cybersecurity & Malware
0XC00D27DF NS_E_DRM_LICENSE_CERT_EXPIRED Fix: 0XC00D27DF on Windows 0X80093201 0x80093201 ASN1 CryptoAPI CRYPT_E_EXTENDED fix 0X80093107 ASN1 (0X80093107) Buffer Overflow Fix – Stop the Crash Now 0X80090029 0x80090029 Fix: NTE_NOT_SUPPORTED on Windows 10/11
NTE_BAD_LEN 0x80090004 DPAPI corrupt certificate private key Windows credential encryption fix 0x80090004 NTE_BAD_LEN Outlook NTE_BAD_LEN Windows Hello DPAPI_NT_USER_KEYS reset DPAPI migrate user profile

Was this solution helpful?

EP
Erropedia Team
Tech Support Editors
The Erropedia editorial team researches and documents real-world tech errors from across Windows, Linux, macOS, networking, databases, cloud platforms, and more. Every solution is reviewed for accuracy and updated as software and systems evolve.