disabled by administrator encryption policy or credential storage