| Previous | Next |
| ERROR_BAD_VALIDATION_CLASS | ERROR_NO_SECURITY_ON_OBJECT |
ERROR_BAD_TOKEN_TYPE
The operation received the wrong kind of access token
Windows explicitly distinguishes TokenPrimary and TokenImpersonation. A process security context is represented by a primary token, while a thread can use an impersonation token to act in another security context. Many security APIs require one specific token type. This error means the token handle can be valid and queryable but is semantically unsuitable for the attempted operation.
Query TokenType with GetTokenInformation at the point the handle enters the failing API. Trace where the token was created or duplicated: DuplicateTokenEx can request a primary or impersonation token, while server impersonation naturally gives a thread token. Also inspect impersonation level when an impersonation token is involved. Do not fix the problem by casting structures or reusing a token handle in another role; duplicate or obtain the correct token type with the access rights required by the downstream operation.
What to inspect
- Query TokenType and, for impersonation tokens, TokenImpersonationLevel.
- Trace the API that created or duplicated the token handle.
- Obtain the correct token type instead of reusing a valid handle in the wrong role.
References
Looking for a different code? Search another status or error code.