| Previous | Next |
| SEC_I_COMPLETE_AND_CONTINUE | SEC_I_CONTEXT_EXPIRED |
SEC_I_LOCAL_LOGON
Authentication completed using local logon information
SEC_I_LOCAL_LOGON is HRESULT 590613 (0x00090315) from winerror.h. AllStat describes it as “The logon was completed, but no network authority was available; The logon was made using locally known information.” The severity bit indicates a nonfailure result, but the value carries a specific condition that must not be collapsed into plain S_OK.
In the SSPI authentication or message-protection state machine, this result means that the logon was completed, but no network authority was available; The logon was made using locally known information. Ordinary completion must not be inferred from it until the owning component’s state and outputs agree.
What must be true before accepting it
Verify that the caller understands that no network authority participated and evaluates whether local-only credentials satisfy the resource policy. Only this contract check establishes that this result is safe for the caller’s next step.
The return of this result can follow observable side effects, so recovery begins with state reconciliation.
Where the status is encountered
- This result can be returned during InitializeSecurityContext or AcceptSecurityContext loops; log the exact method and object state instead of interpreting the constant outside that contract.
- It can be returned during Schannel or another security package; log the exact method and object state instead of interpreting the constant outside that contract.
- It can be returned during message signing, fragmentation, or asynchronous SSPI processing; log the exact method and object state instead of interpreting the constant outside that contract.
Because it is informational, a language binding may expose it as success and hide the symbolic distinction. Keep the original HRESULT available until the code-specific branch has run.
Evidence and telemetry
- preserve security package.
- preserve target name.
- preserve account SID and domain field.
- preserve network authority availability.
- preserve requested delegation or network access.
Also record sec_i_local_logon_operation, sec_i_local_logon_state_before, sec_i_local_logon_state_after, UTC time, process and thread identifiers, component version, and a correlation ID. For privacy-safe it diagnostics, log metadata and fingerprints instead of confidential source values.
Correct handling and recovery
Accept only for operations that allow local authentication. For network authorization, obtain a context backed by the required authority and avoid presenting local logon as domain validation.
Retry it only when a documented input or state has changed. Before another call following it, confirm that completed side effects are idempotent or reconciled.
Practical scenario
A workstation authenticates a local maintenance account while the domain controller is unavailable. The tool permits local repair but blocks access to domain resources.
A regression test should reproduce it, assert the relevant outputs and state, then change only the decisive condition and verify the expected neighboring result or ordinary completion.
Difference from nearby results
It must be distinguished from ordinary S_OK and from failure-severity values in the same API family; its documented state changes control the next action.
A nearby HRESULT can change object ownership, output validity, or the permitted next method.
References
- Microsoft: SSPI status codes — official Microsoft material used to interpret it.
- Microsoft: SSPI context semantics
- Microsoft: InitializeSecurityContext
- Microsoft: DecryptMessage
- Microsoft: HRESULT values
Looking for a different code? Search another status or error code.