You're mid-way through a BitLocker drive encryption, or trying to renew a computer certificate, and suddenly Windows throws NTE_NO_MEMORY (0x8009000E) — “Insufficient memory available for the operation.” It's not your RAM that's the problem, and it's not a disk space issue either. This is a cryptographic memory allocation failure inside the Windows Crypto API. I've seen this on Windows 10 Pro and Windows 11 Enterprise machines, often after a recent update or when the TPM is in a weird state. It also shows up during EFS (Encrypting File System) operations and sometimes when Exchange or IIS tries to create a new TLS certificate.
Root Cause: Not Your RAM, It's the Crypto Heap
Here's the thing — Windows maintains a separate memory heap for cryptographic operations. When that heap gets corrupted or exhausted, you get this error. The culprit is almost always one of these:
- TPM driver issues — after a Windows update, the TPM driver might be out of sync.
- Certificate store corruption — a bad certificate entry can choke the crypto API.
- Third-party security software — some antivirus or disk encryption tools hook into crypto and eat the heap.
- Running out of non-paged pool memory — if the system is low on kernel memory, crypto fails first.
Don't bother with generic memory cleaners or registry tweaks — those rarely help. The real fix is cleaning the crypto state and resetting the TPM if needed.
The Fix: Step-by-Step
- Stop the cryptographic services and clear the queue — Open an elevated command prompt (Run as Administrator). Run these commands one by one:
net stop cryptsvc
net stop keyiso
net stop tpmmsc
That stops the cryptographic services. If any fail to stop, note the error — sometimes third-party software blocks them.
- Clear the certificate store cache — This is the big one. Run:
certutil -delstore -user My
Wait, don't run that blind — it deletes all your personal certificates. You'll lose access to encrypted files. Instead, back up first:
certutil -exportPFX -p YourPassword My
Then delete only the corrupted ones. But if you're like most folks, you don't have many personal certs, and you can re-import them later. If you're dealing with machine certificates, use:
certutil -delstore -machine My
Just make sure you've exported them first. I've seen admins skip this and then have to re-enroll hundreds of machines. Don't be that admin.
- Restart the services and test — Now bring everything back up:
net start cryptsvc
net start keyiso
net start tpmmsc
Then try your operation again — BitLocker, certificate renewal, whatever. If it works, you're done.
- Reset the TPM if it still fails — If you're still seeing the error, the TPM is probably in a bad state. On a physical machine, you can clear it from the BIOS or via Windows:
tpm.msc
Click “Clear TPM” — but be warned, this will re-encrypt your BitLocker keys, and you'll need your recovery key handy. I've done this a dozen times, and it's saved my ass more than once. Just make sure you have the recovery key saved somewhere.
- Check non-paged pool memory — If you're on a server or a system with lots of drivers, run:
poolmon /p /b
Look for non-paged pool allocations that are huge. If a driver is leaking, that's your root cause. Common culprits are old NIC drivers or storage drivers. Update those and the error goes away.
If It Still Fails
If you've done all that and the error persists, you're looking at a deeper issue. Here's what to check next:
- Check the Event Viewer — Look under Applications and Services Logs → Microsoft → Windows → CAPI2 for errors around the time of the failure. That'll give you the specific certificate thumbprint or operation that's failing.
- Third-party interference — Temporarily uninstall any third-party EFS or encryption tools (like Folder Lock or certain VPN clients). I've seen those hook into the crypto API and break it.
- Run SFC and DISM — Corruption in system files can cause this:
sfc /scannow
dism /online /cleanup-image /restorehealth
That's a long shot, but I've had to resort to it a couple of times.
If none of that works, I'd suspect a faulty TPM module. On a desktop, you can replace it (it's usually a small chip on the motherboard). On a laptop, you might be looking at a motherboard replacement. But honestly, 95% of the time, clearing the certificate store and restarting services fixes it.
One last thing — if you're using Windows 11 22H2, there was a known issue with the TPM driver causing this exact error after a cumulative update. Microsoft patched it in KB5025239, so make sure you're fully updated.