NTE_HMAC_NOT_SUPPORTED Fix – 0x8009002F on Windows 10/11

You're getting 0x8009002F — NTE_HMAC_NOT_SUPPORTED. It means the crypto provider on your Windows machine can't do Hash Message Authentication Code. I've seen this on Windows 10 21H2 and Windows 11 22H2. It shows up during RDP connections, VPN authentication, or when a service tries to use TLS. The machine still works for other stuff. But any HMAC operation fails.

Cause 1: Schannel registry tweak that breaks HMAC

The culprit here is almost always a registry key under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel. Some admin or group policy set a cipher suite order that doesn't include HMAC. Or they disabled certain hash algorithms. I've seen this after someone tried to "harden" TLS by removing SHA-1, but they went too far.

Here's the fix:

1. Open regedit as admin.
2. Go to HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel.
3. Look for a key named Ciphers or Hashes. If it exists, export it, then delete it.
4. Also check HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings — delete any Security_HKLM_only or Schannel_DefaultCipherSuites entries.
5. Reboot the machine.

Don't bother with Group Policy Editor if this is a standalone machine. The local policy rarely causes this. For domain-joined machines, check the GPO under Computer Configuration > Administrative Templates > Network > SSL Configuration Settings. Disable any custom cipher suite order policy.

Cause 2: Corrupted CNG key storage

If the registry fix didn't work, the crypto provider's key store is probably borked. This happens after a failed update or when a third-party tool messes with the Microsoft Software Key Storage Provider. The error logs in Event Viewer show Provider 'Microsoft Software Key Storage Provider' returned error 0x8009002F.

Do this:

1. Open PowerShell as admin.
2. Run:

   certutil -delkey -csp "Microsoft Software Key Storage Provider"

3. This deletes all machine-level keys. Don't panic — Windows re-creates them on next use.
4. Then run:

   net stop CryptSvc && net start CryptSvc

5. Reboot.

If you're on a domain, this might break certificate auto-enrollment for a few minutes. It's fine. The certificates re-register within an hour.

Cause 3: Missing or corrupted TLS 1.2 support

Older Windows 10 versions (pre-20H2) sometimes lose TLS 1.2 support after a bad .NET update. HMAC depends on TLS 1.2's hash algorithms. If the schannel.dll is corrupted or the registry doesn't enable TLS 1.2, you get 0x8009002F.

Check these registry keys:

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\TLS 1.2\Client
DisabledByDefault = 0 (DWORD)
Enabled = 1 (DWORD)

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\TLS 1.2\Server
DisabledByDefault = 0 (DWORD)
Enabled = 1 (DWORD)

If those don't exist, create them. Set the values, reboot. Also run Windows Update to get the latest schannel fixes. Skip the DISM /RestoreHealth trick — it's overkill for this error.

Quick reference summary

Start with the registry fix. It's the most common. If that doesn't work, clear the CNG keys. The TLS 1.2 check is your fallback. I've never seen a case where all three were needed.