| Previous | Next |
| ERROR_NO_IMPERSONATION_TOKEN | ERROR_NO_LOGON_SERVERS |
ERROR_CANT_DISABLE_MANDATORY
A mandatory SID in the access token cannot be disabled with normal group adjustment
TOKEN_GROUPS associates every group SID with attribute flags. SE_GROUP_MANDATORY specifically prevents AdjustTokenGroups from clearing SE_GROUP_ENABLED for that SID. The failure therefore describes a token-group attribute rule, not a directory group-membership problem. Removing the account from an Active Directory group and disabling a SID already present in a token are separate operations with different lifetimes.
Inspect the token entry and its attributes before retrying. If the security design requires a reduced token, Microsoft documents CreateRestrictedToken as the mechanism that can convert mandatory SIDs to deny-only use. Also remember that existing tokens are snapshots of security context: changing account membership does not retroactively rewrite every token already created for the logon session. Reauthenticate or create the intended restricted token rather than repeatedly calling AdjustTokenGroups against a mandatory entry.
What to inspect
- Read TokenGroups and identify the SID carrying SE_GROUP_MANDATORY.
- Use a restricted-token design when the goal is to reduce effective group access.
- Do not treat directory membership changes as an in-place edit of existing access tokens.
References
Looking for a different code? Search another status or error code.