| Previous | Next |
| STATUS_INVALID_PACKAGE_SID_LENGTH | STATUS_ADMINLESS_ACCESS_DENIED |
STATUS_LPAC_ACCESS_DENIED
The resource is not granted to the LPAC security context
LPAC is more restrictive than a normal AppContainer. Resources that grant access through ALL APPLICATION PACKAGES are not automatically available to an LPAC; access must come from a more specific package SID, capability, or an ACL entry intended for restricted application packages. This status therefore points to the effective LPAC token and resource security descriptor.
Broadly adding access for all users defeats the isolation goal and can create a new vulnerability. Production sandboxes instead grant narrowly scoped rights to the exact files, registry keys, named objects, or broker endpoints required. Chromium documentation provides a practical example of preparing ACLs for binaries and data needed by LPAC targets.
What to inspect
- Query TokenIsLessPrivilegedAppContainer and enumerate package and capability SIDs from the effective token.
- Inspect the target object DACL and the desired access mask that failed.
- Grant the smallest required rights to a specific package, process, or capability SID where appropriate.
- Check parent-directory traversal and named-object namespace ACLs, not only the final object.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: TOKEN_INFORMATION_CLASS
- Microsoft: launch an AppContainer
- Chromium: Windows sandbox and LPAC design
Looking for a different code? Search another status or error code.