| Previous | Next |
| SL_E_SFS_INVALID_TOKEN_DESCRIPTOR | E_HANDLE |
E_ACCESSDENIED
E_ACCESSDENIED — 0x80070005
E_ACCESSDENIED means the callee rejected the caller token or an access/launch permission before the requested work could begin.
Meaning in the subsystem
A missing object or invalid argument is not access denial; confirm that the target exists and that the request reached its authorization check.
Minimum useful evidence
- The effective user, integrity level, elevation state, impersonation level, and session
- The object identity, CLSID/AppID or securable resource and the requested access mask
- COM launch/access permissions, service security descriptor, and any per-object ACL
- The first failing API and the security event or Procmon access result at the same timestamp
Isolate the responsible condition
- Repeat with the same binary under the intended production identity rather than an administrator account.
- Compare local activation with remote activation while keeping CLSID and credentials fixed.
- Temporarily grant only the exact missing right in a test environment and verify that the failure point moves.
Avoid the common misdiagnosis
Read the comparison results in this order:
Regression proof
Apply the smallest change that addresses the first rejected condition: Repair the launch/access ACL, service identity, file or registry permission that denies the documented operation; do not solve it by permanently running the whole client elevated.
Close the incident only when the original identity can complete the operation with least privilege, while a deliberately unprivileged control still receives access denied.
Technical references
These references define the HRESULT family and subsystem contract used above:
Looking for a different code? Search another status or error code.