What does Windows error code 1223 (ERROR_CANCELLED) mean?

 
Previous Next
ERROR_NO_NETWORK ERROR_USER_MAPPED_FILE

ERROR_CANCELLED

The operation was canceled by the user.

ERROR_CANCELLED is Win32 error 1223 (0x4C7). Many Windows APIs use it to report an intentional cancellation path: a user closed a dialog, pressed Cancel, rejected elevation, or a higher-level controller requested that work stop. Cancellation is an outcome to propagate, not automatically a product defect.

Identify who canceled and at what stage

  • interactive user action, service stop, timeout controller, or dependent task
  • operation correlation ID and cancellation-token generation
  • last completed phase and any irreversible side effects
  • whether the underlying API acknowledged cancellation or merely stopped reporting progress
  • time between the cancel request and final completion callback

Cleanup responsibilities

Close handles, release temporary files, unregister callbacks, and stop progress UI, but do not roll back completed external effects unless the operation contract supports rollback. A canceled copy may leave a partial destination; a canceled installer may have committed earlier transactions; a canceled query usually leaves no persistent state. Document the boundary for each operation.

User-facing behavior

Present a neutral message such as “Canceled” and preserve the user’s input where safe. Avoid alarming error dialogs or automatic retry, because retrying can undo the user’s explicit choice. If cancellation was caused by closing an elevation prompt, explain that the requested privileged action did not run without claiming that credentials were wrong.

Developer guidance

  • treat cancellation as a distinct status in public APIs
  • make completion callbacks fire exactly once
  • handle races between normal completion and cancel requests
  • ensure synchronous and asynchronous paths map cancellation consistently
  • test repeated cancel, late cancel, and cancel during shutdown

Difference from aborted requests

ERROR_REQUEST_ABORTED says a request was aborted, often by a transport or lower-level subsystem, and may not represent a direct user choice. ERROR_OPERATION_ABORTED is frequently associated with canceled overlapped I/O. Error 1223 explicitly carries the user-canceled meaning in its system text.

Retry policy

Do not retry automatically after 1223. A new attempt should require a new user action or a clearly documented controller decision. If telemetry shows frequent cancellations at the same phase, investigate usability, duration, or unexpected prompts rather than classifying the cancellations as infrastructure failures.

Example

A certificate import wizard validates a file and then asks the user to select a store. The user presses Cancel, and the API returns 1223. The application deletes its temporary decoded data, keeps the original file untouched, records a non-error cancellation event, and waits for the user to start a new import.

References

Looking for a different code? Search another status or error code.