Windows error 1660 (ERROR_SET_CONTEXT

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: Windows denied modification of a thread context because the target process restricts that operation.

Previous	Next
ERROR_STRICT_CFG_VIOLATION	ERROR_CROSS_PARTITION_VIOLATION

ERROR_SET_CONTEXT_DENIED

The target process does not permit its thread context to be changed.

ERROR_SET_CONTEXT_DENIED is Win32 error 1660 (0x67C). Setting thread context can redirect execution, change registers, or alter debugging state. Protected, hardened, or policy-restricted processes may deny the operation even when the caller can open the thread. The code commonly appears in debuggers, profilers, injectors, crash tools, compatibility layers, and security products that attempt to use SetThreadContext or an equivalent mechanism.

Why the context update is rejected

the target process applies a mitigation or protection level that forbids context modification
the caller lacks the required thread rights or crosses an integrity or trust boundary
the thread belongs to a protected service, antimalware process, secure component, or isolated environment
a debugger or instrumentation method is unsupported for this target architecture or process type
endpoint security intentionally blocks behavior that resembles code injection or thread hijacking

Evidence for debugging the debugger

Record caller and target process IDs, image paths and signers, thread ID, desired access mask, integrity levels, protection levels, architecture, WOW64 state, effective mitigation policies, whether the thread was suspended, context flags requested, and the exact API return. Never log full register state from sensitive processes into ordinary telemetry.

Diagnostic method

Verify the handle rights and use the architecture-appropriate context API. Confirm that the thread is in a state supported by the API and that another debugger has not changed ownership or lifecycle. Then inspect target protection and mitigation policy; administrative elevation alone does not override every protected-process boundary.

Reproduce with a Microsoft-supported debugger or profiler interface. If that succeeds while custom instrumentation fails, compare attachment method and requested operations. Treat a denial against security software or credential-handling processes as expected until vendor documentation explicitly permits the scenario.

Supported response

Use a documented debugging, tracing, ETW, dump, or profiler interface that does not require rewriting thread context. Obtain a vendor-supported diagnostic build when necessary. Do not weaken system-wide process protection or deploy a kernel bypass merely to preserve an unsupported injection technique.

Tool developers should detect restricted targets early, explain the limitation, and avoid partial instrumentation after a context update fails. Roll back any suspension or allocated remote state before returning the error.

Difference from invalid context data

Invalid flags, architecture mismatch, or a stale thread handle indicate malformed input or lifecycle errors. Error 1660 specifically states that the context update is restricted for the process. The correct question is whether the operation is permitted, not only whether the register values are valid.

Example

A profiler opens a protected antimalware process and suspends a worker thread, but its attempt to redirect the instruction pointer returns 1660. The profiler resumes the thread and switches to ETW-based sampling instead of trying to bypass the process protection.

References

Looking for a different code? Search another status or error code.