Fix NS_E_SETUP_DRM_MIGRATION_FAILED 0XC00D2AFD

You're running a Windows 10 feature update (say, 22H2 to 23H2) or an in-place upgrade from Windows 8.1 to 10. At around 60-70% through the setup, it throws NS_E_SETUP_DRM_MIGRATION_FAILED (0XC00D2AFD). The setup rolls back, wasting an hour of your time. I've seen this most often on machines that played a lot of old WMA or WMV files from the Windows Media Player days – the ones with DRM licenses that are older than the user account itself.

What's actually happening here

The Windows upgrade process tries to copy your DRM licenses from the old Windows to the new one. These licenses live in C:\ProgramData\Microsoft\Windows\DRM. The problem? One or more of those license files is either corrupted, has wrong permissions, or the file name is too long for the migration engine to handle. Windows setup doesn't skip bad license files – it fails the whole migration step. That's the error you see.

This isn't a network issue or a missing update. It's a filesystem-level problem with DRM data that Windows Media Player and its copy protection system left behind. The fix is to clear those old licenses before upgrading. You'll lose the ability to play any DRM-protected media you had, but let's be real – that's probably stuff from 2010 you don't need anymore.

The fix: clear DRM files before upgrading

Skip the fancy tools. This is a manual file delete job. You need an admin account.

Close everything – especially Windows Media Player, any Media Center app, or anything that plays protected content.
Open a command prompt as admin – hit Win+X, pick Terminal (Admin) or Command Prompt (Admin).
Stop the DRM service if it's running – type this and hit Enter:
```
net stop drm
```
It'll probably say it's not running. That's fine.
Take ownership of the DRM folder – this step is why just deleting in Explorer fails. Run:
```
takeown /f "C:\ProgramData\Microsoft\Windows\DRM" /r /d y
```

Grant yourself full control – then:

icacls "C:\ProgramData\Microsoft\Windows\DRM" /grant Administrators:F /t

Delete everything inside the DRM folder – but not the folder itself:
```
del /f /s /q "C:\ProgramData\Microsoft\Windows\DRM\*"
```
Run the upgrade again – no reboot needed. Launch the Windows setup (setup.exe from the ISO or the Windows Update page).

The reason step 3 matters: the DRM service locks some license files. If you don't stop it first, the delete command will skip locked files and you'll still have the problem. I've had setups fail again because I skipped step 3.

If it still fails

Two things to check:

Check the DRM folder permissions – after step 5, run icacls "C:\ProgramData\Microsoft\Windows\DRM" and make sure your admin account shows (F) for full control. If it says 'Access Denied' on the folder itself, you didn't take ownership properly. Rerun step 4 and 5.
Look for leftover files – sometimes a file named something like drmstore.hds or indivbox.key is hidden or read-only. Run dir /a /s "C:\ProgramData\Microsoft\Windows\DRM" to see everything. If anything's still there, delete it with del /f /a "filename".

If you're upgrading from Windows 7 or 8, the path might be slightly different: C:\ProgramData\Microsoft\Windows\DRM is the same, but the permissions system is older – you might need to use cacls instead of icacls. Just swap icacls for cacls in step 5 and you're good.

One more thing: if you have multiple user accounts, each one might have its own DRM licenses inside that folder. The delete command wipes them all. Every user loses their DRM rights. Tell your family or coworkers before you do this. I forgot once, and it was a mess.

After the upgrade finishes, you can re-acquire DRM licenses by playing the protected file again (WMP will prompt you to get a new license from the provider). Most old services are dead though, so don't count on it. The tradeoff is a working OS.