What does NTSTATUS 0xC00002EE (STATUS_UNFINISHED_CONTEXT_DELETED) mean?

STATUS_UNFINISHED_CONTEXT_DELETED

A multi-step SSPI handshake was torn down before reaching its terminal success state

STATUS_UNFINISHED_CONTEXT_DELETED is an SSPI lifecycle failure. InitializeSecurityContext and AcceptSecurityContext can require multiple token exchanges; SSPI documents continuation statuses such as SEC_I_CONTINUE_NEEDED and a loop in which client and server feed returned tokens back into the corresponding context call until success or error.

The status differs from STATUS_NO_SECURITY_CONTEXT. Here a context existed, but the application deleted it before negotiation completed. Common code-level causes include treating a continuation result as failure, closing the connection after sending a token but before receiving the peer response, reusing one context variable for concurrent connections, or cleanup running on a timeout without synchronizing with the handshake owner.

Capture every SSPI call in order with context identity, connection identity, input/output token lengths and returned status. Never log opaque authentication tokens as plain diagnostic text. The key question is which path called DeleteSecurityContext while the state machine still expected another InitializeSecurityContext or AcceptSecurityContext step.

What to inspect

• The ordered SSPI return statuses for both peers, especially continuation and completion-required results.
• The lifetime mapping between socket/stream, credential handle, and security-context handle.
• Timeout, cancellation, error-cleanup, and connection-close paths that can delete a context concurrently with authentication.

References

• Microsoft: AcceptSecurityContext sequencing
• Microsoft: InitializeSecurityContext
• Microsoft: DeleteSecurityContext
• Microsoft: SSPI status codes
• Microsoft Open Specifications: NTSTATUS values

Looking for a different code? Search another status or error code.