| Previous | Next |
| STATUS_INVALID_GROUP_ATTRIBUTES | STATUS_CANT_OPEN_ANONYMOUS |
STATUS_BAD_IMPERSONATION_LEVEL
The server cannot act for the client at the requested level
Windows distinguishes Anonymous, Identification, Impersonation, and Delegation levels. A server can inspect identity at Identification level, but local resource access on behalf of the client normally requires Impersonation. Delegation is required when the client identity must be carried to another computer.
The failure often appears after a token was duplicated with the wrong level or when an RPC, named-pipe, or COM client restricted impersonation through security quality-of-service settings. Elevating the server account does not change the level embedded in the client token.
What to inspect
- Query TokenStatistics and record both TokenType and ImpersonationLevel.
- Capture the client security quality-of-service flags used when the connection or handle was created.
- Request only the minimum level required, and duplicate the token explicitly when a different level is necessary.
References
- Microsoft: Impersonation levels
- Microsoft: TOKEN_STATISTICS
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.