Fix SEC_E_SECPKG_NOT_FOUND (0x80090305) on Windows
This error means Windows can't find the security package needed for authentication. Here's how to fix it fast.
This error is a real pain, I know.
You're trying to connect to a remote server, access a network share, or run an app that needs authentication, and bam — SEC_E_SECPKG_NOT_FOUND (0x80090305). Windows is basically screaming "I don't know what security package you're asking for." It's common in enterprise environments after a patch, a domain migration, or when someone accidentally nuked a registry key. Let's fix it.
The most common fix: Restore the Negotiate package
In 90% of cases, the issue is that the Negotiate security package is missing or corrupted. This package handles Kerberos and NTLM fallback. Without it, authentication fails immediately.
Open an elevated Command Prompt (right-click, Run as Administrator) and run:
reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProvidersYou should see something like:
SecurityProviders REG_SZ negotiate, credssp, pku2u, schannelIf negotiate isn't there, that's your problem. Add it back with:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders" /ve /t REG_SZ /d "negotiate,credssp,pku2u,schannel" /fThen reboot. Test your connection. If it works, great. If not, move on.
Why this works
The SecurityProviders registry value is a comma-separated list of DLLs that Windows loads as security packages. The Negotiate package (negotiate.dll) is the entry point for Kerberos and NTLM. Without it, the Local Security Authority Subsystem (LSASS) can't negotiate which security protocol to use. So any call to InitializeSecurityContext with the Negotiate package fails with 0x80090305. I've seen this happen after a bad Group Policy update that overwrites the list, or after a Windows feature update that removes it.
Less common variations
1. Missing Schannel package
If you're getting this error in a web browser or an app using TLS/SSL (like PowerShell Invoke-WebRequest), the Schannel package might be missing. Check the same registry key — if schannel isn't in the list, add it the same way. You'll also want to verify the Schannel DLL exists at C:\Windows\System32\schannel.dll.
2. Corrupted security package DLL
Sometimes the registry entry is fine, but the actual DLL is corrupt or blocked by antivirus. Run sfc /scannow from an elevated prompt to repair system files. Then run dism /online /cleanup-image /restorehealth for good measure. Reboot after.
3. Group Policy overriding the list
If you're on a domain, your IT team might have a policy that sets the SecurityProviders list. Check Computer Configuration -> Administrative Templates -> System -> Kerberos -> (something like "Security Packages"). If the policy is enabled, it will override your local registry changes. You'll need to ask your admin to update the policy or exclude your machine.
4. Third-party security software interference
I've seen VPN clients, antivirus suites, and firewall apps remove or replace security packages. Check your installed software list. If you added something recently, try uninstalling it and see if the error goes away. McAfee and Symantec endpoint products have been known to mess with Negotiate.
5. Corrupted LSA (Local Security Authority) configuration
If the above doesn't work, the LSA might be in a bad state. Run reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa and look for the Security Packages value (notice it's a different key than the one we fixed earlier — this one is under Lsa, not SecurityProviders). It should list the same packages. If it's missing, add it:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "Security Packages" /t REG_MULTI_SZ /d "negotiate\0credssp\0pku2u\0schannel" /fNote: This key uses REG_MULTI_SZ, so each package must be on its own line in the data. The above command uses null separators. Reboot after.
Prevention
Once you've got it fixed, don't let it happen again. Here's how:
- Before any Windows update or patch, export the SecurityProviders and Lsa Security Packages registry keys. Right-click each key, select Export, and save them somewhere safe. If the error returns, just double-click the .reg file.
- Monitor Group Policy changes — if your organization pushes a security policy, check the SecurityProviders setting. If it's set incorrectly, push back.
- Keep a clean backup — use System Restore or a full disk image before making changes to authentication. I've learned this the hard way on production servers.
- Test in a lab first — if you're an admin, never test security package changes on a live domain controller. Use a VM or a non-production machine.
That's it. The 0x80090305 error is frustrating, but usually it's just a missing entry in the registry. Start with the Negotiate package, check Schannel if it's TLS-related, and don't forget Group Policy. You should be back up in 10 minutes.
Was this solution helpful?