NTE_BAD_KEY (0X80090003) – Quick Fix for Corrupt Windows Keys

Quick answer (for the impatient)

Run these two commands as Admin, then reboot:

certutil -delstore MY "YOUR_THUMBPRINT_HERE"
certutil -repairstore MY "YOUR_THUMBPRINT_HERE"

If you don't know the thumbprint, skip to step 3 below.

Why this happens

I've seen 0X80090003 mostly on Windows 10 20H2 through 22H2, but it also hits Server 2019 and 2022. The core problem: Windows' cryptographic key store (usually the DPAPI or machine key set) gets corrupted. This can happen after a bad update, a disk-full condition when the OS was writing keys, or after a sudden power loss during a BitLocker unlock. The error often shows up when you try to sign into Microsoft 365, unlock BitLocker, or run net use with a certificate.

Step-by-step fix

1. Identify the bad key. Open an elevated Command Prompt (Win+X > Terminal (Admin)). Run:

   certutil -store MY

   Look for any entry with a status of "Bad Key" or a thumbprint that lines up with the error's log entry. Write down the thumbprint (40 hex characters).
   
   
2. Delete the bad key. Replace THUMBPRINT with what you found:

   certutil -delstore MY THUMBPRINT

   This removes the corrupt certificate from the personal store.
   
   
3. Repair the key store. If you can't find a thumbprint, or step 2 didn't help, rebuild the entire machine key store:

   certutil -repairstore -user MY ""

   The empty quotes tell it to repair all keys in the store. This takes 10-30 seconds.
   
   
4. Reboot. Not optional. The crypto service won't reload fresh keys until after a restart.

Alternative fixes if the main steps fail

Clear the DPAPI master key

Sometimes the corruption is in the Data Protection API (DPAPI), not the certificate store. Open an Admin command prompt and run:

del /s /q %APPDATA%\Microsoft\Protect\*.*
del /s /q %USERPROFILE%\AppData\Local\Microsoft\Protect\*.*

This clears all user-level protection keys. You'll lose saved passwords for browsers and credential manager entries, but the system will regenerate them on next login. Don't do this on a domain-joined machine without checking with your domain admin—it can break group policy encryption.

BitLocker-specific fix

If the error shows up when unlocking BitLocker, you need your recovery key. Boot from the Windows installation media, go to Troubleshoot > Advanced Options > Command Prompt, then run:

manage-bde -unlock C: -RecoveryPassword YOUR-48-DIGIT-KEY
manage-bde -protectors -disable C:

Replace C: with the affected drive. Then reboot normally and re-enable protectors after the drive is unlocked.

TPM reset (last resort)

If the error persists and you've ruled out everything else, the TPM chip may have a corrupt key. Reset it from the BIOS or use this command in Windows (requires admin):

tpm.msc

Click "Clear TPM". Warning: This wipes all BitLocker keys, PINs, and Windows Hello credentials. Have your BitLocker recovery key ready before doing this.

Prevention tip

The #1 cause of this error is running out of disk space during a Windows update or BitLocker operation. Keep at least 20 GB free on your system drive. If you use BitLocker, export your recovery key to a separate drives or print it—don't rely on Microsoft account recovery unless you're sure it's synced. Also, avoid using third-party crypto software (like VeraCrypt) alongside Windows' built-in encryption—they fight over the key store and cause corruption.

Oh, and one more thing: if you're on a corporate network, check with your security team before clearing the DPAPI or TPM. They might have GPOs that re-encrypt everything and lock you out.