Fix PERSIST_E_SIZEINDEFINITE 0x800B000A on Windows

Quick answer

0x800B000A means the file or token Windows is trying to read has no valid length header, so the OS can't figure out how many bytes to load. Fix it by rebuilding the cert store or clearing the software licensing cache, depending on which subsystem threw the error.

What's actually going on

I know this error is infuriating. It pops up in the middle of an activation, a DISM run, or a Windows Update install and gives you a hex code that reads like a punchline. The literal translation of PERSIST_E_SIZEINDEFINITE is: the caller asked for a size, and the file returned "indefinite" instead of a number. Windows does this a lot with certificate blobs, Software Protection Platform tokens, and .wim/.esd image files. When the header is truncated, zero-length, or padded with garbage, the parser bails out with 0x800B000A.

Real-world trigger I see on the help desk almost weekly: a machine that was cloned from a VM template, or restored from a Macrium Reflect image mid-update. The tokens.dat file under C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\ClipSVC\tokens.dat gets written half-way and the length field ends up empty. From that point on, every activation call and every slmgr /ato returns 0x800B000A. Same story with certclients certs when you import a PFX and pull the USB drive before the write flushes.

Fix 1 — Run the activation and licensing repair sequence

This is the one that works 70% of the time. Do it in an elevated Command Prompt, in order. Skipping steps or running them out of sequence won't help — the SPP service needs to be fully stopped before you can touch tokens.dat.

Open Task Manager, kill sppsvc.exe if it's running. Windows keeps it alive even when the UI says it's stopped.
Run the following in an admin cmd window:

net stop sppsvc
net stop CryptSvc
net stop bits
cd /d %windir%\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\ClipSVC
ren tokens.dat tokens.old
net start CryptSvc
net start bits
net start sppsvc
slmgr /rilc
slmgr /ato

The slmgr /rilc command re-installs the default license files from scratch. It takes 30–90 seconds. If you get a different error here (0xC004F074 or 0x8007232B), that's actually good news — it means the file corruption is cleared and you're now looking at a network or key issue, which is a much easier problem.

Fix 2 — Repair the certificate store

If the error fires from certutil, PowerShell's Get-ChildItem Cert:\, or a .NET app loading an X.509 cert, the problem is in the user or machine cert store, not licensing. You'll usually spot this when certutil -store My returns an entry with a blank size field.

certutil -store -v My
taskkill /f /im certutil.exe
certutil -delstore My "<thumbprint-of-bad-cert>"

Then re-import the cert from a known-good source. Don't re-import from the same PFX — the file itself may be the problem. If it's a code signing cert from your CA, pull a fresh one. If it's a user cert, re-enroll via the Certificate Enrollment wizard: certmgr.msc → Personal → All Tasks → Request New Certificate.

Fix 3 — DISM and WIM file repair

DISM throws 0x800B000A when the install.wim or install.esd it's reading has a truncated XML manifest. This happens a lot with USB installers created by Rufus in DD mode, or with ISOs that were downloaded over a flaky connection. Verify the ISO hash first:

certutil -hashfile C:\path\to\windows.iso SHA256

Compare it against the value on Microsoft's download page. If it doesn't match, redownload. If the hash is fine, mount the WIM and check the manifest manually:

dism /Mount-Wim /WimFile:C:\sources\install.wim /Index:1 /MountDir:C:\mount
dir C:\mount\Windows\System32\config\

If dism /Get-WimInfo itself fails with 0x800B000A, the image is toast. Grab a fresh ISO and re-create the USB with Fat32 formatting and MBR (for BIOS) or GPT (for UEFI).

Alternative fixes if the above fail

System Restore: roll back to a point before the error started. This is the fastest path if you have a restore point from the last 7 days.
In-place upgrade repair: mount a Windows ISO, run setup.exe from the running OS, and choose "Keep personal files and apps." This rebuilds the SPP and cert subsystems without wiping your data.
Reset the Crypto folder: stop CryptSvc, rename C:\Windows\System32\catroot2 to catroot2.old, reboot. Windows rebuilds it on next start. Slow but effective when certutil keeps choking.
Check disk health: if this error appears alongside random other failures, run chkdsk C: /f /r. A dying SSD will hand Windows truncated files and you'll chase ghosts for days.

Prevention

Don't clone Windows VMs after activation — sysprep them with sysprep /generalize /oobe /shutdown first, or you'll get a corrupted tokens.dat on every clone. And when you import certs, let the write finish before you unplug anything. The 3 seconds you save isn't worth a 0x800B000A at 2 AM.