| Previous | Next |
| ERROR_INVALID_PRIMARY_GROUP | ERROR_CANT_DISABLE_MANDATORY |
ERROR_NO_IMPERSONATION_TOKEN
The caller expected a thread impersonation token, but the thread was using its process security context
A process normally has a primary access token. A thread can additionally carry an impersonation token when it is acting in a client security context. This error means an operation specifically targeting an impersonation token was attempted while the thread was not currently impersonating. Opening the process token does not manufacture the missing thread token, and primary and impersonation tokens are not interchangeable merely because they identify the same user.
Check the call sequence that establishes impersonation and the exact thread on which the token operation runs. Thread-pool dispatch, asynchronous callbacks, or an early RevertToSelf can move code away from the impersonated context. Query TokenType and use the effective-thread-token APIs when appropriate. For server code, always test whether impersonation succeeded before processing client requests; otherwise privileged work may accidentally continue under the service process token.
What to inspect
- Confirm the same thread successfully entered impersonation before opening its token.
- Query TokenType instead of assuming a token handle is an impersonation token.
- Audit asynchronous and thread-pool boundaries that can lose thread-local impersonation state.
References
Looking for a different code? Search another status or error code.