dotnet/wpf · error · ArgumentOutOfRangeException

ArgumentOutOfRangeException(userActivationMode)

Error message

ArgumentOutOfRangeException(userActivationMode)

What it means

SecureEnvironment.Create(applicationManifest, AuthenticationType, UserActivationMode) accepts only UserActivationMode.Permanent or UserActivationMode.Temporary. Any other UserActivationMode value throws ArgumentOutOfRangeException for 'userActivationMode', guarding against undefined activation semantics.

Solutions

Pass UserActivationMode.Permanent explicitly (persist activation across runs) or UserActivationMode.Temporary (destroyed on Dispose)
Check any enum value read from config/settings for defined values before calling Create
Initialize enum fields with a valid value rather than relying on the 0 default

Example fix

// before
UserActivationMode mode = default; // 0, not defined
var env = SecureEnvironment.Create(manifest, AuthenticationType.Windows, mode);

// after
UserActivationMode mode = UserActivationMode.Permanent;
var env = SecureEnvironment.Create(manifest, AuthenticationType.Windows, mode);

Defensive patterns

Strategy: validation

Validate before calling

if (userActivationMode is not (UserActivationMode.Permanent or UserActivationMode.Temporary))
    throw new InvalidOperationException($"Invalid UserActivationMode: {userActivationMode}");

Type guard

static bool IsValidActivationMode(UserActivationMode m) =>
    m is UserActivationMode.Permanent or UserActivationMode.Temporary;

Try / catch

try { var env = SecureEnvironment.Create(manifest, auth, userActivationMode); }
catch (ArgumentOutOfRangeException ex) when (ex.ParamName == "userActivationMode")
{
    logger.LogError(ex, "Activation mode {Mode} undefined", userActivationMode);
}

Prevention

Initialize enum settings with explicit valid values, never default(0)
When loading UserActivationMode from config, validate against Enum.IsDefined before use
Prefer explicit fields: mode = UserActivationMode.Permanent

When it happens

Trigger: Calling the activation overload of SecureEnvironment.Create with a UserActivationMode value that is not Permanent or Temporary — typically an uninitialized enum (0), a cast from an int, or a value from configuration.

Common situations: Defaulting an enum field that never got set (default(UserActivationMode) or 0 is not a defined mode); deserializing an int from config; a settings binding failing and leaving the enum at its default.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/ada04589b3125e2c. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/SecureEnvironment.cs:281

        }

        private static SecureEnvironment CriticalCreate(
            string applicationManifest, 
            AuthenticationType authentication,
            UserActivationMode userActivationMode)
        {
            ArgumentNullException.ThrowIfNull(applicationManifest);

            if ((authentication != AuthenticationType.Windows) && 
                 (authentication != AuthenticationType.Passport))
            {
                throw new ArgumentOutOfRangeException(nameof(authentication));
            }

            if ((userActivationMode != UserActivationMode.Permanent) &&
                 (userActivationMode != UserActivationMode.Temporary))
            {
                throw new ArgumentOutOfRangeException(nameof(userActivationMode));            
            }

            //build user with the given authnetication type and a default name 
            // only authentication type is critical in this case 
            ContentUser user; 
            
            using (ClientSession tempClientSession =
                ClientSession.DefaultUserClientSession(authentication))
            {
                //Activate Machine if neccessary
                if (!tempClientSession.IsMachineActivated())
                {
                    // activate Machine
                    tempClientSession.ActivateMachine(authentication);
                }

                //Activate User (we will force start activation at this point)
                // at this point we should have a real user name

View on GitHub (pinned to 81131a70a4)