BSOD 70 (DEREF_UNKNOWN_LOGON_SESSION): causes and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A kernel component dereferenced a logon-session object that was not known to the security subsystem.

Could be also:
Constant	Type	OS
ERROR_SHARING_PAUSED	Win32 error	Windows
ECOMM	errno	Linux
ESTALE	errno	Mac
ECOMM	errno	Solaris

DEREF_UNKNOWN_LOGON_SESSION

Unknown logon-session dereference

DEREF_UNKNOWN_LOGON_SESSION is bug check code 0x00000046. Logon sessions are security-accounting objects. This bug check means reference tracking around a logon-session object failed during dereference, suggesting corruption, stale references, or incorrect security callback behavior.

How to read it in a dump

The failing path should be interpreted with security subsystem, token, LSA/logon, and object-reference state in mind.
Do not treat it as a bad password or normal authentication failure; it is kernel bookkeeping.
Look for endpoint, audit, authentication, or file-system/security filter drivers.

What to check

Inspect token and logon-session references in the dump.
Check security products and kernel callbacks around logon/session lifecycle.
Use verifier for drivers that retain token, process, or security object references.

References

Looking for a different code? Search another status or error code.