| Previous | Next |
| DB_E_BADBINDINFO | DB_E_NOTAREFERENCECOLUMN |
DB_SEC_E_PERMISSIONDENIED
Meaning
Windows documents DB_SEC_E_PERMISSIONDENIED as “Permission denied”. Here, the data source recognizes the caller but denies the requested OLE DB operation.
Evidence to collect before changing the system
When it involves credentials, access tokens, principal identifiers and protected data, record types, lengths, hashes or redacted identifiers instead of secrets or full business data.
- Evidence 1: the authenticated principal and effective security context.
- Evidence 2: the exact object, method and requested access mode.
- Evidence 3: provider error records, server audit entries and policy decision details.
Relevant OLE DB contract
This result must be interpreted against this contract: OLE DB security results depend on the identity actually presented to the provider and the authorization applied to the specific data source object, command, table or row; authentication and permission denial are distinct stages.
Start with the provider connection, effective principal and protected object or operation when investigating this result.
Specific conditions that produce it
- Cause 1: the principal lacks table, column, procedure or object permission.
- Cause 2: the connection is running under a different identity than expected.
- Cause 3: row-level or provider policy denies the selected object or operation.
Corrective actions
- Action 1: grant only the minimum permission required for the documented operation.
- Action 2: correct impersonation, delegation or service-account selection.
- Action 3: surface authorization failure without logging credentials or protected row data.
Practical incident
A Windows service connects using its machine account instead of the configured domain account and can read metadata but not rows; correcting the service identity resolves it.
Retry and recovery policy
Retry rule: retry only after authorization or the requested scope changes; repeated attempts under the same denied identity should stop.
Difference from related HRESULT values
DB_SEC_E_AUTH_FAILED means authentication itself failed, while DB_SEC_E_PERMISSIONDENIED means an authenticated identity lacks authorization.
Official Microsoft references
Looking for a different code? Search another status or error code.