| Previous | Next |
| ERROR_ALLOTTED_SPACE_EXCEEDED | ERROR_BAD_IMPERSONATION_LEVEL |
ERROR_INVALID_GROUP_ATTRIBUTES
A group SID was paired with an invalid set of access-token attributes
Group entries in TOKEN_GROUPS are SID_AND_ATTRIBUTES records. Flags control whether a SID is enabled for access checks, mandatory, deny-only, an integrity SID, a logon SID, or eligible as an owner. Some combinations have defined semantics and others cannot represent a valid token group state. This error describes those token attributes, not the directory attributes or scope of an Active Directory group object.
Dump the exact SID and bitmask supplied for every group entry. Check for combinations such as trying to mark a deny-only SID enabled, or carrying internal/logon attributes into a caller-built token structure without the matching semantics. When changing an existing token, prefer documented token APIs instead of rebuilding TOKEN_GROUPS from guessed flags. If validation information comes from an authentication package, verify the package output and group expansion before LSA builds the token.
What to inspect
- Log each group SID with its exact Attributes bitmask.
- Compare flags with documented TOKEN_GROUPS semantics and mutually exclusive states.
- Determine whether the invalid entry was caller-built or returned by an authentication package.
References
Looking for a different code? Search another status or error code.