{"record":{"id":"647e2ab6ebc6c095","repo":"dotnet/wpf","slug":"needsgroupidentityactivation","errorCode":"NeedsGroupIdentityActivation","errorMessage":"RightsManagementFailureCode.NeedsGroupIdentityActivation","messagePattern":"RightsManagementFailureCode\\.NeedsGroupIdentityActivation","errorType":"error_code","errorClass":"RightsManagementException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/SecureEnvironment.cs","lineNumber":247,"sourceCode":"        /// <summary>\n        /// This static Method builds a new instance of a secure environment for a given user that is assumed to be already activated. \n        /// client Application can use GetActivatedUsers property to enumerate Activated users.\n        /// </summary>\n        private static SecureEnvironment CriticalCreate(string applicationManifest, ContentUser user)\n        {\n            ArgumentNullException.ThrowIfNull(applicationManifest);\n            ArgumentNullException.ThrowIfNull(user);\n\n            // we only let specifically identifyed users to be used here  \n            if ((user.AuthenticationType != AuthenticationType.Windows) && \n                 (user.AuthenticationType != AuthenticationType.Passport))\n            {\n                throw new ArgumentOutOfRangeException(nameof(user));\n            }\n\n            if (!IsUserActivated(user))\n            {\n                throw new RightsManagementException(RightsManagementFailureCode.NeedsGroupIdentityActivation);\n            }\n            \n            ClientSession clientSession = new ClientSession(user);\n\n            try\n            {\n                clientSession.BuildSecureEnvironment(applicationManifest);\n\n                return new SecureEnvironment(applicationManifest, user, clientSession);\n            }\n            catch\n            {\n                clientSession.Dispose();\n                throw;\n            }\n        }\n\n        private static SecureEnvironment CriticalCreate(","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/SecureEnvironment.cs#L229-L265","documentation":"SecureEnvironment.Create checks whether the given user is already activated for this machine (IsUserActivated). If not, it throws RightsManagementException with FailureCode.NeedsGroupIdentityActivation instead of silently activating. The caller must use the (applicationManifest, AuthenticationType, UserActivationMode) overload of Create to run activation first.","triggerScenarios":"Calling SecureEnvironment.Create(manifest, user) on a machine where the user (or the machine) has never been activated — first run of the app, after RemoveActivatedUser, on a new machine or new user profile, or after RM store corruption.","commonSituations":"Deploying an app that skips the activation flow; a user switching domains/accounts; cleaning RM state in troubleshooting and forgetting to re-activate.","solutions":["Call the other overload SecureEnvironment.Create(manifest, AuthenticationType.Windows, UserActivationMode.Permanent) first to activate, then Create(manifest, user)","Check SecureEnvironment.IsUserActivated(user) before Create and branch to the activation flow","Persist activation state expectations in your app: on NeedsGroupIdentityException, prompt and activate rather than crash","Use UserActivationMode.Temporary if per-session activation is acceptable and you want no machine-state change"],"exampleFix":"// before\nvar env = SecureEnvironment.Create(manifest, user); // throws if not activated\n\n// after\nif (!SecureEnvironment.IsUserActivated(user))\n{\n    var activatingEnv = SecureEnvironment.Create(manifest, AuthenticationType.Windows, UserActivationMode.Permanent);\n    activatingEnv.Dispose();\n}\nvar env = SecureEnvironment.Create(manifest, user);","handlingStrategy":"try-catch","validationCode":"bool ready = SecureEnvironment.IsUserActivated(user);\nif (!ready)\n{\n    using var temp = SecureEnvironment.Create(manifest, AuthenticationType.Windows, UserActivationMode.Permanent);\n    // user now activated\n}","typeGuard":"static bool IsReadyToBind(SecureEnvironment _) => true; // guard instead:\nstatic bool NeedsActivation(ContentUser u) => !SecureEnvironment.IsUserActivated(u);","tryCatchPattern":"try { var env = SecureEnvironment.Create(manifest, user); }\ncatch (RightsManagementException ex) when (ex.FailureCode == RightsManagementFailureCode.NeedsGroupIdentityActivation)\n{\n    // activate once, then retry Create\n    using var activating = SecureEnvironment.Create(manifest, AuthenticationType.Windows, UserActivationMode.Permanent);\n    var env = SecureEnvironment.Create(manifest, user);\n}","preventionTips":["Always probe IsUserActivated before Create(manifest, user)","Handle first-run activation in application startup, not at the point of consuming content","After RemoveActivatedUser or machine changes, expect to re-activate"],"tags":["rights-management","drm","activation","wpf"],"backgroundTag":"authentication-required","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}