What does Windows error code 1310 (ERROR_CANT_DISABLE_MANDATORY) mean?

 
Previous Next
ERROR_NO_IMPERSONATION_TOKEN ERROR_NO_LOGON_SERVERS

ERROR_CANT_DISABLE_MANDATORY

A mandatory SID in the access token cannot be disabled with normal group adjustment

TOKEN_GROUPS associates every group SID with attribute flags. SE_GROUP_MANDATORY specifically prevents AdjustTokenGroups from clearing SE_GROUP_ENABLED for that SID. The failure therefore describes a token-group attribute rule, not a directory group-membership problem. Removing the account from an Active Directory group and disabling a SID already present in a token are separate operations with different lifetimes.

Inspect the token entry and its attributes before retrying. If the security design requires a reduced token, Microsoft documents CreateRestrictedToken as the mechanism that can convert mandatory SIDs to deny-only use. Also remember that existing tokens are snapshots of security context: changing account membership does not retroactively rewrite every token already created for the logon session. Reauthenticate or create the intended restricted token rather than repeatedly calling AdjustTokenGroups against a mandatory entry.

What to inspect

  • Read TokenGroups and identify the SID carrying SE_GROUP_MANDATORY.
  • Use a restricted-token design when the goal is to reduce effective group access.
  • Do not treat directory membership changes as an in-place edit of existing access tokens.

References


Looking for a different code? Search another status or error code.