BSOD 40 (CORRUPT_ACCESS_TOKEN): causes and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: CORRUPT_ACCESS_TOKEN

Could be also:
Constant	Type	OS
KERN_LOCK_OWNED	Kern return	Mac
ippStsWrongIntersectVOI	Intel Ipp Status	Any
ELOOP	errno	Linux
EMSGSIZE	errno	Mac
EL3RST	errno	Solaris
ENOSYS	errno	Windows

Previous	Next
RDR_FILE_SYSTEM	SECURITY_SYSTEM

CORRUPT_ACCESS_TOKEN

CORRUPT_ACCESS_TOKEN is bug check 0x28. Microsoft marks it as very infrequent and publishes no stable meanings for its four arguments. The symbolic name points to the stop-code category, but the public reference does not define which token field, operation, or security principal must be corrupt.

Avoid turning the name into an unsupported diagnosis

An access token is a kernel security object, yet 0x28 alone does not identify a user account problem, an ACL error, or malware. Those conclusions require separate evidence. The dump should be used to establish the failing execution path and the kernel component manipulating security state when the stop was raised.

Dump workflow

Preserve the four arguments and exact OS build even though Microsoft does not document portable field meanings.
Use !analyze -show 0x28 to query debugger-known stop information for the installed tools, then inspect the crash with !analyze -v.
Review the stack and loaded modules before deciding whether the fault belongs to a security driver, another kernel component, or broader memory corruption.

References

Looking for a different code? Search another status or error code.