After Windows 11 26H2 update: apps lose saved logins, WhatsApp won't open (DPAPI "Could not get the master key") - cause and fix

I ran into the same problem after a Windows update in September. I guess it might be because I had 'Use my sign-in info to automatically finish setting up after an update' turned on. But I don’t have a restore point from before the update, so even now, my event log keeps generating events 8198, 8203, and 3. I just want the event log to stop creating these events.🥲

@🐻 祺
Sorry you hit this too. The good news: you can usually make those events stop even without a restore point. The events are not random: some app still has data encrypted with a master key Windows can no longer open, and it retries every time it runs. Find that app and the events stop.

STEP 1. Get the GUID of the lost key

Event Viewer > Applications and Services Logs > Microsoft > Windows > Crypto-DPAPI > Operational. Open one Event 3 ("Master key access failed") and copy the MasterKeyGUID. Usually it is always the same GUID.

STEP 2. Try to bring the old key back first (takes 2 minutes)

The key is unlocked by the credential you sign in with. In my case the PIN opened the old key again while the web sign-in had created a new one. So:

• Sign out and sign in with your PASSWORD (Sign-in options > key icon), use the PC for a few minutes and check if new Event 3 entries with that GUID still appear.
• Then do the same signing in with your PIN.

If the events stop with one of them, keep using that method: your old data may be readable again.

Do NOT delete files in %APPDATA%\Microsoft\Protect, and do not reset your PIN or password while testing.

STEP 3. If the key is really gone, find which app is retrying

This read-only PowerShell script lists the files in your profile that still reference that GUID. It does not change or decrypt anything. Save it as Find-DpapiOrphans.ps1 and run (normal PowerShell, no admin):

powershell -ExecutionPolicy Bypass -File .\Find-DpapiOrphans.ps1 -Guid <the-GUID-from-step-1>

(script below)

On a typical profile it takes 1 to 8 minutes. You will usually see a few apps, for example a browser or an Electron/WebView2 app ("...\Local State", "LocalPrefs.json"), Credential Manager files (...\Microsoft\Credentials...), or cache folders of game launchers.

STEP 4. Let each app recreate its data

The data in those files is already unreadable, so you lose nothing more by recreating it:

• Cache folders (BrowserCache, CEF, WebView2Cache, EBWebView inside a launcher): close the app and move that file/folder to a backup folder. The app recreates it.
• Apps with a sign-in (Discord, Teams, a browser, etc.): sign out and sign in again in the app. If the events continue, close the app and move its "Local State" file to a backup folder; it will create a new key and ask you to sign in.
• Files under ...\Microsoft\Credentials: these are Credential Manager entries that can no longer be read. Move them to a backup folder and re-enter the passwords when Windows asks.

Prefer moving to a backup folder over deleting, in case the key comes back.

STEP 5 (last resort). Only hide the events

If you just want the log to stop and do not care about the cause, in an elevated Command Prompt:

wevtutil sl Microsoft-Windows-Crypto-DPAPI/Operational /e:false

This only disables that diagnostic log; it does not fix anything. To turn it back on: /e:true.

To avoid it next time: Settings > Accounts > Sign-in options > turn off "Use my sign-in info to automatically finish setting up after an update", and avoid the "I forgot my PIN" / web sign-in option.

Script (Find-DpapiOrphans.ps1):

<#

  Find-DpapiOrphans.ps1

  Lists files in your user profile that still contain data encrypted with a given

  DPAPI master key (use the GUID shown in Event 3 / Event 8203 of the

  Crypto-DPAPI/Operational log).

  Read-only: it does not change, copy or decrypt anything.

  Usage (normal PowerShell, no admin needed):

    powershell -ExecutionPolicy Bypass -File .\Find-DpapiOrphans.ps1 -Guid 01234567-89ab-cdef-0123-456789abcdef

#>

param(

    [Parameter(Mandatory)][Guid]$Guid,

    [int]$MaxMB = 32

)

# The master key GUID appears as 16 raw bytes inside every DPAPI blob.

# Search it as a Latin-1 string (1 byte = 1 char), which is fast in .NET.

$latin1 = [Text.Encoding]::GetEncoding(28591)

$needle = $latin1.GetString($Guid.ToByteArray())

# JSON files (e.g. "Local State" of Chromium/Electron apps) store the blob as Base64,

# so also search the 3 possible Base64 alignments of the GUID.

$b64 = foreach ($pad in 0..2) {

    $s = [Convert]::ToBase64String([byte[]](@(0) * $pad) + $Guid.ToByteArray())

    $s.Substring(4, 16)

}

# Folders and file types that never hold DPAPI data (caches, programs, media, code).

$skipDirs = @('\Cache\', '\Code Cache\', '\GPUCache\', '\Temp\', '\CrashDumps\', '\INetCache\',

              '\WebCache\', '\CacheStorage\', '\Microsoft\Protect\', '\Docker\', '\wsl\',

              '\node_modules\', '\.git\', '\Programs\', '\pip\', '\npm-cache\', '\NuGet\',

              '\ShaderCache\', '\DawnCache\', '\Extensions\', '\WinGet\', '\Windows\Explorer\')

$skipExt = @('.exe', '.dll', '.sys', '.msi', '.pak', '.asar', '.node', '.js', '.mjs', '.ts', '.css',

             '.html', '.png', '.jpg', '.jpeg', '.gif', '.webp', '.ico', '.svg', '.bmp', '.mp3',

             '.mp4', '.wav', '.ogg', '.webm', '.ttf', '.otf', '.woff', '.woff2', '.pdb', '.py',

             '.pyc', '.jar', '.class', '.zip', '.7z', '.cab', '.etl', '.evtx', '.wasm', '.map', '.md')

function Get-Files([string]$dir) {

    $stack = New-Object System.Collections.Stack

    $stack.Push($dir)

    while ($stack.Count) {

        $d = $stack.Pop()

        try { foreach ($sub in [IO.Directory]::EnumerateDirectories($d)) {

                $probe = $sub + '\'

                $skip = $false

                foreach ($s in $skipDirs) { if ($probe.Contains($s)) { $skip = $true; break } }

                if (-not $skip) { $stack.Push($sub) } } } catch { }

        try { foreach ($f in [IO.Directory]::EnumerateFiles($d)) { $f } } catch { }

    }

}

$roots = @($env:APPDATA, $env:LOCALAPPDATA, (Join-Path $env:USERPROFILE 'AppData\LocalLow'))

$sw = [Diagnostics.Stopwatch]::StartNew()

$scanned = 0

$hits = New-Object System.Collections.Generic.List[object]

foreach ($r in $roots) {

    foreach ($path in (Get-Files $r)) {

        if ($skipExt -contains [IO.Path]::GetExtension($path).ToLowerInvariant()) { continue }

        try {

            $info = New-Object IO.FileInfo $path

            if ($info.Length -le 40 -or $info.Length -gt ($MaxMB * 1MB)) { continue }

            $scanned++

            $text = $latin1.GetString([IO.File]::ReadAllBytes($path))

            $found = $text.IndexOf($needle, [StringComparison]::Ordinal) -ge 0

            if (-not $found) {

                foreach ($s in $b64) { if ($text.IndexOf($s, [StringComparison]::Ordinal) -ge 0) { $found = $true; break } }

            }

            if ($found) { $hits.Add([pscustomobject]@{ LastWrite = $info.LastWriteTime; File = $path }) }

        } catch { }

    }

}

"Scanned $scanned files in {0:N0}s." -f $sw.Elapsed.TotalSeconds

if ($hits.Count) { $hits | Sort-Object File | Format-Table -AutoSize -Wrap | Out-String -Width 300 }

else { "No files found referencing master key $Guid." }