| Previous | Next |
| STATUS_INVALID_PRIMARY_GROUP | STATUS_CANT_DISABLE_MANDATORY |
STATUS_NO_IMPERSONATION_TOKEN
The thread has no impersonation token
This status belongs to the access-token and impersonation path. A server thread can have both its process primary token and a temporary client impersonation token; this result says the requested operation expected the latter and the thread was not impersonating at that point.
Diagnose the RPC, named-pipe, ALPC, COM, or driver callback path that should have established impersonation. Retrying an access check with the process primary token can produce a different security result and may hide the real bug.
What to inspect
- Confirm whether the code called an impersonation API before querying or duplicating the token.
- Record the impersonation level and whether the transport allows delegation or identification only.
- Check cleanup paths that can revert impersonation before the failing call.
References
- Microsoft: Impersonation tokens
- Microsoft: Access tokens
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.