NTSTATUS 0xC000A200 (STATUS_NOT_APPCONTAINER): meaning

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The operation requires an AppContainer token, but the effective caller lacks one.

Previous	Next
STATUS_RUNLEVEL_SWITCH_IN_PROGRESS	STATUS_NOT_SUPPORTED_IN_APPCONTAINER

STATUS_NOT_APPCONTAINER

The caller does not have an AppContainer security context

AppContainer is an orthogonal property of a Windows access token, not merely another integrity level. An AppContainer token carries a package or profile SID and capability SIDs used in access checks. This status means an API restricted to that model was invoked from an ordinary process or from a thread whose effective token lacks AppContainer information.

Launching the executable from a package directory does not prove that it runs in AppContainer. Packaged applications can use different trust levels, and unpackaged programs must explicitly create and launch with an AppContainer profile. The correct fix is usually in process creation or broker design, not an ACL that grants broad access to the ordinary caller.

What to inspect

Query TokenIsAppContainer and TOKEN_APPCONTAINER_INFORMATION on the effective token used by the call.
Check whether thread impersonation replaced an AppContainer process token with a non-AppContainer token.
Verify package trust level, profile creation, SECURITY_CAPABILITIES, and process-launch attributes.
Do not emulate AppContainer by only lowering integrity level; the token and capability model is different.

References

Looking for a different code? Search another status or error code.