What causes "Could not update secure setting "{key}" for user "{userName}"." in Devolutions/UniGetUI?

Verify the target username exists and the host account can access its profile store

Devolutions/UniGetUI · error · InvalidOperationException

Could not update secure setting

Error message

Could not update secure setting "{key}" for user "{userName}".

What it means

SetSettingAsync throws when SecureSettings.TrySet (for the current user) returns false, or ApplyForUser (for another user) returns non-zero. Secure settings are persisted via the OS secure store (DPAPI/registry); a failure means the underlying write was denied or the target profile is unreachable.

Solutions

Verify the target username exists and the host account can access its profile store
For cross-user writes, run the host with sufficient privileges
Isolate the fault by writing for the current user first, then retry for the other user

Example fix

// before
await IpcSecureSettingsApi.SetSettingAsync(req); // targets unknown user
// after
if (!UserExists(req.UserName)) return Result.BadRequest("unknown user");
try { await IpcSecureSettingsApi.SetSettingAsync(req); }
catch (InvalidOperationException ex) { logger.Error(ex); return Result.Fail(); }

Defensive patterns

Strategy: try-catch

Try / catch

try
{
    return await IpcSecureSettingsApi.SetSettingAsync(request);
}
catch (InvalidOperationException ex) when (ex.Message.StartsWith("Could not update secure setting"))
{
    logger.Error(ex, "Secure store write failed for {User}", request.UserName);
    return Result.Fail("secure-store-unavailable");
}

Prevention

Resolve the target user before the call
Run the host with rights to the profiles it manages
Distinguish current-user vs cross-user paths in error handling

When it happens

Trigger: Setting a secure setting for a target user whose profile cannot be resolved, or when the host process lacks rights to the target user's secure store.

Common situations: IPC host running under an account without privileges to the target user's store; corrupt target profile; non-existent target username.

Related errors

AI-assisted analysis of Devolutions/UniGetUI@9b1d7d0eab (2026-08-13). Data as JSON: /api/errors/0e83743b8ff8a6de. Report an issue: GitHub.

Appendix: source

Thrown at src/UniGetUI.Interface.IpcApi/IpcSecureSettingsApi.cs:52

    {
        return ToSecureSettingInfo(ResolveSettingKey(settingKey), ResolveUserName(userName));
    }

    public static async Task<IpcSecureSettingInfo> SetSettingAsync(
        IpcSecureSettingRequest request
    )
    {
        ArgumentNullException.ThrowIfNull(request);
        var key = ResolveSettingKey(request.SettingKey);
        string userName = ResolveUserName(request.UserName);

        bool success = userName.Equals(Environment.UserName, StringComparison.OrdinalIgnoreCase)
            ? await SecureSettings.TrySet(key, request.Enabled)
            : SecureSettings.ApplyForUser(userName, SecureSettings.ResolveKey(key), request.Enabled) == 0;

        if (!success)
        {
            throw new InvalidOperationException(
                $"Could not update secure setting \"{SecureSettings.ResolveKey(key)}\" for user \"{userName}\"."
            );
        }

        return ToSecureSettingInfo(key, userName);
    }

    private static IpcSecureSettingInfo ToSecureSettingInfo(
        SecureSettings.K key,
        string userName
    )
    {
        return new IpcSecureSettingInfo
        {
            Key = key.ToString(),
            Name = SecureSettings.ResolveKey(key),
            UserName = userName,
            IsCurrentUser = userName.Equals(Environment.UserName, StringComparison.OrdinalIgnoreCase),

View on GitHub (pinned to 9b1d7d0eab)