| Previous | Next |
| ERROR_CLOUD_FILE_PROPERTY_CORRUPT | ERROR_CLOUD_FILE_INCOMPATIBLE_HARDLINKS |
ERROR_CLOUD_FILE_ACCESS_DENIED
CFAPI rejected the caller's access to the placeholder or sync root
ERROR_CLOUD_FILE_ACCESS_DENIED can arise from local access requirements, not only remote service authorization. For example, CfConnectSyncRoot requires suitable access to the sync root, CfSetPinState requires read-data or write-DAC access, and CfSetInSyncState requires write-data or write-DAC access. Active-root management policy can impose additional provider-ownership restrictions.
Log the caller token, integrity level, requested access, handle creation flags, target ACL, and whether the process owns the active provider connection. Avoid treating elevation as the universal fix: the intended solution may be opening an attribute-only handle with the documented rights or routing the request through the connected provider. Separate this local status from remote authentication and account authorization failures.
What to inspect
- Record the exact access mask used to open the root or placeholder.
- Check NTFS ACLs and connected-provider ownership independently.
- Use the least documented access required by the specific CFAPI call.
References
- Microsoft: sync-root access required by CfConnectSyncRoot
- Microsoft: access required to change pin state
- Microsoft: access required to change in-sync state
Looking for a different code? Search another status or error code.