What does NTSTATUS 0xC0000414 (STATUS_VDM_DISALLOWED) mean?

STATUS_VDM_DISALLOWED

The 16-bit execution environment is blocked, not merely missing an application DLL

STATUS_VDM_DISALLOWED reports that execution of a 16-bit application is not permitted. This is different from STATUS_IMAGE_SUBSYSTEM_NOT_PRESENT, which says a required image subsystem is absent, and different from a normal file-access denial on the executable. The status points at the policy/permission decision around VDM execution.

Microsoft documents NTVDM as the 16-bit DOS/Windows application environment on supported 32-bit Windows. It is not included with 64-bit Windows, so platform architecture must be established before investigating permission policy. On a 32-bit system with NTVDM available, capture the user/token context and any organizational compatibility controls that govern 16-bit application execution.

Check the executable image type, OS architecture, account and elevation context, and whether other 16-bit applications can start under the same user. Do not copy NTVDM files from another system or rename the executable to bypass image detection. If the application is business-critical, the durable solution may be an approved compatibility environment or application migration; weakening execution policy globally merely to suppress this status changes the security boundary for all 16-bit code.

What to inspect

• Confirm that the target really is a 16-bit image and record the operating-system architecture.
• Compare execution under the same user with a known permitted 16-bit program to isolate policy from image corruption.
• Review the policy that governs VDM use before changing file ACLs; ordinary read/execute permission is not the only decision involved.

References

• Microsoft: NTVDM and 16-bit app support
• Microsoft: PE format
• Microsoft: Process creation flags
• Microsoft: Application compatibility
• Microsoft Open Specifications: NTSTATUS values

Looking for a different code? Search another status or error code.