Fix NTE_PROV_TYPE_ENTRY_BAD (0X80090018) in 3 Steps

The 30-Second Fix: Re-register the CNG Provider

This error usually pops up when you try to sign in with Windows Hello, run a BitLocker operation, or open a certificate in MMC. The culprit is almost always a misregistered cryptographic provider — specifically the Microsoft Key Protection Provider or the Platform Crypto Provider.

Open an admin Command Prompt (Win+X, Terminal Admin) and run this:

regsvr32 /u /s %windir%\system32\cngprovider.dll
regsvr32 /s %windir%\system32\cngprovider.dll

That re-registers the core provider. If the error pops up in Event Viewer as a warning, this often clears it. Don't bother rebooting — if it worked, you'll know instantly. Test by trying the action that failed.

Still broken? Move to the moderate fix.

The 5-Minute Fix: Blow Out the Corrupted Registry Key

If re-registering didn't work, the provider type entry in the registry is corrupted. You'll find it here:

HKLM\SYSTEM\CurrentControlSet\Control\Cryptography\Providers\Microsoft Key Protection Provider

But don't just delete that key — you need to remove the Type value and let Windows recreate it. Here's the safe way:

1. Open Regedit as admin.
2. Navigate to HKLM\SYSTEM\CurrentControlSet\Control\Cryptography\Providers.
3. Look for any subkey with a Type DWORD set to 0 or 1 that doesn't match the provider's actual purpose. The Key Protection Provider's Type should be 1 (Key Storage Provider).
4. Right-click the Type value and delete it.
5. Close Regedit, then run regsvr32 /s %windir%\system32\cngprovider.dll again.

This forces Windows to regenerate the Type value on next boot. If the error was tied to a specific app (like a VPN client or a certificate enrollment tool), this usually nails it.

Still seeing the error? Time for the heavy artillery.

The 15+ Minute Fix: Nuke the Cryptographic Provider Stack

This is the nuclear option. Something deeper is corrupted — maybe from a failed Windows update or a third-party crypto driver that left trash behind. Here's the playbook:

Step 1: Find the offending provider

Open PowerShell as admin and run:

Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Cryptography\Providers" | ForEach-Object { $_.PSPath; Get-ItemProperty $_.PSPath | Select-Object Type }

Look for any provider with a Type value that's 0 when it should be 1 or 2. Note the exact key name.

Step 2: Remove the provider

Delete the entire provider key (not just the Type value). Back it up first:

reg export "HKLM\SYSTEM\CurrentControlSet\Control\Cryptography\Providers\BadProviderName" C:\backup_provider.reg

Then delete the key:

reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Cryptography\Providers\BadProviderName" /f

Step 3: Rebuild the crypto stack

Run the following in order. Don't skip any:

dism /online /cleanup-image /restorehealth
sfc /scannow
regsvr32 /s %windir%\system32\cngprovider.dll
regsvr32 /s %windir%\system32\ncryptprov.dll

Reboot. This rebuilds the entire CNG stack. I've seen this fix errors that persisted through in-place upgrades.

When to give up and reinstall

If you've done all three steps and the error still comes back, it's a corrupted TPM or firmware issue. Try clearing the TPM (Win+R, tpm.msc, click "Clear TPM") — but warn the user this wipes BitLocker keys. On Dell or HP business machines, a BIOS update often resolves it. Otherwise, a clean Windows install is your last stop.

One more thing — if this error shows up in certlm.msc when viewing certificates, it's a specific bug from a bad KB update in late 2023. Uninstall KB5029351 or KB5030211 if you see them in Installed Updates.