CredentialsChanged() is failing with error -2147019873 in CredentialProvider

Question

We are using CredentialProvider in C++ for Windows, On calling OnCredentialsChanged(), Sometimes CredentialsChanged() is failing with HRESULT hr -2147019873.

Answer 1

Hi @SHARVANI ATCHULA , sorry for late response!

The HRESULT -2147019873 maps to 0x80072EE7 (ERROR_INTERNET_NAME_NOT_RESOLVED), which indicates a DNS or network name resolution failure. This error originates from the underlying Win32 networking stack, not from the Credential Provider API itself.

Credential Providers run inside LogonUI.exe, where network availability is not guaranteed, especially during boot, lock screen, or user-switch scenarios. If ICredentialProviderEvents::CredentialsChanged() (https://learn.microsoft.com/en-us/windows/win32/api/credentialprovider/nf-credentialprovider-icredentialproviderevents-credentialschanged) is called when the network stack or DNS is not yet available, intermittent failures are expected. This method is designed as a best-effort notification and should not be treated as a fatal operation.

To make the provider more robust, avoid network-dependent work during credential enumeration or change notifications, and handle failures from CredentialsChanged() gracefully (for example, by logging and retrying later). General guidance on Credential Provider behavior and limitations is available here: https://learn.microsoft.com/en-us/windows/win32/secauthn/credential-providers-in-windows

If you find my answer's useful, please kindly mark it as final answer! Thanks

Answer 2

The error code -2147019873 corresponds to WINBIO_E_CRED_PROV_DISABLED, which indicates that the credential provider is not enabled system-wide. This can happen if the credential provider has not been properly registered or if it has been disabled in the system settings.

To resolve this issue, you should check the following:

1. Ensure that your credential provider is correctly registered in the Windows registry.
2. Verify that the credential provider is enabled for the user or domain you are trying to authenticate.
3. If you are developing a custom credential provider, ensure that you have implemented the necessary interfaces and methods correctly, including handling the OnCredentialsChanged() method appropriately.

If the problem persists, consider checking the event logs for any additional error messages that might provide more context on why the credential provider is disabled.