What does HRESULT 0x00090323 (SEC_I_NO_LSA_CONTEXT) mean?

 
Previous Next
SEC_I_RENEGOTIATE SEC_I_SIGNATURE_NEEDED

SEC_I_NO_LSA_CONTEXT

Security context has no associated LSA-mode context

SEC_I_NO_LSA_CONTEXT is HRESULT 590627 (0x00090323) from winerror.h. The documented description is “There is no LSA mode context associated with this context.” The severity bit indicates a nonfailure result, but the value carries a specific condition that must not be collapsed into plain S_OK.

In the SSPI authentication or message-protection state machine, this result means that there is no LSA mode context associated with this context. Before reporting completion, the caller must reconcile the code-specific state transition and every usable output.

What must be true before accepting it

Verify that the requested operation truly does not require an LSA-mode representation of the context. Without that proof, this result can mask a caller error even though HRESULT failure severity is not set.

Reconcile side effects associated with this result before compensation or a second invocation is attempted.

Where the status is encountered

  • This result can be returned during InitializeSecurityContext or AcceptSecurityContext loops; log the exact method and object state instead of interpreting the constant outside that contract.
  • It can be returned during Schannel or another security package; log the exact method and object state instead of interpreting the constant outside that contract.
  • It can be returned during message signing, fragmentation, or asynchronous SSPI processing; log the exact method and object state instead of interpreting the constant outside that contract.

Evidence to preserve

  • Preserve security package and mode.
  • Preserve context handle generation.
  • Preserve requested LSA-dependent operation.
  • Preserve token or credential outputs.
  • Preserve package attributes.

Correct handling and recovery

Continue only along the user-mode path supported by the security package. Do not call APIs that require an LSA context until the package establishes one.

Practical scenario

A custom security package completes a user-mode operation but has no LSA context for token queries. The caller skips the LSA-only step and records the package mode.

Difference from nearby results

Correctly separating it from neighboring values selects the proper continuation and cleanup path.

References

Looking for a different code? Search another status or error code.