| Previous | Next |
| STATUS_BAD_IMPERSONATION_LEVEL | STATUS_BAD_VALIDATION_CLASS |
STATUS_CANT_OPEN_ANONYMOUS
An Anonymous token cannot be opened for identity inspection
At Anonymous level a server is deliberately prevented from learning or using the client identity. Code that calls OpenThreadToken, queries user and group information, or attempts local access on the client behalf therefore cannot treat the token like an Identification or Impersonation token.
Check the security quality-of-service settings used when the RPC, named-pipe, COM, or other connection was created. Elevating the server process does not change the client impersonation level. Request a higher level only when the protocol and security design require it.
What to inspect
- Record the token type and impersonation level before opening or querying it.
- Inspect client and server security quality-of-service settings.
- Do not fall back to the server identity without an explicit authorization decision.
References
- Microsoft: Impersonation levels
- Microsoft: Access tokens
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.