NTE_TOKEN_KEYSET_STORAGE_FULL (0X80090023) Fix: No Space on Security Token

Quick answer: Open an admin command prompt and run certutil -key -csp Microsoft Platform Crypto Provider to list existing key containers, then delete old or unused ones with certutil -delkey and the container name.

This error—0x80090023 with the message NTE_TOKEN_KEYSET_STORAGE_FULL—pops up when your TPM (Trusted Platform Module) or a hardware smart card has exhausted its allocated storage for cryptographic key containers. I've seen it most often on Windows 10 20H2 and later, especially after enrolling a bunch of virtual smart cards for Microsoft Passport or when a smart card gets clogged with expired certificates. It's a pain, but it's fixable without nuking your whole TPM.

Why This Happens

The TPM has a fixed number of slots for key containers (typically 30-50 depending on the TPM version). Each container holds a key pair tied to a certificate. If you've been swapping certificates, testing software, or using tools like certreq without cleaning up, those slots fill up. The card or TPM doesn't automatically garbage-collect old keys. Once it's full, any attempt to create a new container triggers error 0x80090023.

Step-by-Step Fix: Clear TPM Key Storage

Don't just clear the TPM—that wipes BitLocker keys and Windows Hello credentials. Let's be surgical.

Step 1: Identify What's Eating Space

1. Open an admin command prompt (right-click Start -> Command Prompt (Admin) or Windows Terminal (Admin)).
2. Run:

   certutil -key -csp Microsoft Platform Crypto Provider

   This lists all key containers stored in the TPM. They'll look like Microsoft Passport Key Container 1, Microsoft Passport Key Container 2, or GUIDs.
3. Note which containers are still valid—check their certificates with certutil -store My if you need to.

Step 2: Delete Old Containers

1. For any container you know is orphaned (from a retired user, old certificate, or test), delete it:

   certutil -delkey -csp Microsoft Platform Crypto Provider "Microsoft Passport Key Container 2"

   Replace the name with whatever you see in the list.
2. Repeat for all unwanted containers.

Step 3: Verify Free Space

1. Run the list command again: certutil -key -csp Microsoft Platform Crypto Provider—the count should drop.
2. Try the failing operation again. If it's a certificate enrollment, it should work now.

Alternative Fixes (If the Above Doesn't Work)

Sometimes the TPM itself is buggy or the containers are locked by a process.

Alternative 1: Use TPM Management Console

1. Press Win + R, type tpm.msc, hit Enter.
2. Check TPM status. If it's off, turn it on in BIOS.
3. Right-click the TPM in the left pane and choose Clear TPM—but be warned: this removes all keys, including BitLocker protectors. Have recovery keys ready.

Alternative 2: Disable and Re-enable TPM in Device Manager

1. Open Device Manager, expand Security devices.
2. Right-click Trusted Platform Module 2.0 and select Disable device.
3. Reboot, then enable it again. This flushes stale driver states.

Alternative 3: for Smart Cards

If it's a hardware smart card, use the vendor's management tool (like Gemalto or Entrust) to clear unused keys. For virtual smart cards (Windows Hello), go to Settings > Accounts > Sign-in options > Windows Hello PIN and remove then re-add it.

Prevention Tip

Stop test-driving certificates on production tokens. Use a separate virtual smart card or a temp TPM instance for testing. Also, run certutil -key quarterly and delete old containers (older than 90 days). I set up a scheduled task that emails me the container list every month—catches problems before they lock me out.

If you're still stuck, check the Windows Event Viewer under Applications and Services Logs > Microsoft > Windows > Tpm-WMI > Admin for more clues. But 9 times out of 10, clearing those orphaned containers does the trick.