What does Windows error code 811 (ERROR_HANDLE_REVOKED) mean?

ERROR_HANDLE_REVOKED

Access to the specified handle has been revoked.

ERROR_HANDLE_REVOKED is Win32 error 811 (0x32B) and belongs to revocable Windows object handles.

Where the result appears

• A handle invalidated by a security or isolation boundary.
• Brokered access where the owner can revoke a client capability.
• A resource that was detached while another component retained a handle.
• Cleanup after policy, session, container, or device state changed.

Likely causes

• the authority that issued the handle explicitly revoked it.
• the object moved into a state where previously granted access is no longer valid.
• the process kept a stale handle across reconnect or reconfiguration.
• a broker terminated the grant because the client violated policy.

Troubleshooting steps

• Record handle type and the API that originally returned it.
• Record issuer or broker identity and revocation event.
• Record object lifetime, session, container, and security context.
• Record time between handle creation and the failed use.
• Record whether a replacement handle can be acquired through the documented path.

What to verify

Verify whether the authority that issued the handle explicitly revoked it. Check handle type and the API that originally returned it together with issuer or broker identity and revocation event.

Handling, retry, and recovery

Stop using the revoked value, release dependent state, and reacquire access from the authority that owns the object. Repeating operations on the same numeric handle is unsafe even if the value still looks nonzero.

Difference from nearby codes

A revoked handle is not equivalent to an arbitrary invalid handle; it was once valid and was deliberately withdrawn.

Practical example

A broker grants a client access to a protected object, then policy changes revoke the grant.

References

• Microsoft: System Error Codes (500–999) — reference for error 811.
• Microsoft: File management functions — reference for error 811.