| Previous | Next |
| CO_E_TRUSTEEDOESNTMATCHCLIENT | CO_E_FAILEDTOSETDACL |
CO_E_FAILEDTOQUERYCLIENTBLANKET
COM could not query the client security blanket
CO_E_FAILEDTOQUERYCLIENTBLANKET is HRESULT 2147549480 (0x80010128) from winerror.h. The documented description is “Unable to obtain the client's security blanket.” The relevant context is the COM IAccessControl, DCOM client identity, trustee translation, token inspection, security descriptor, ACL, or serialization workflow.
Where it is encountered
- IAccessControl initialization, access checks, owner/trustee processing, and serialized ACL persistence.
- Server-side DCOM impersonation, client blanket inspection, token and SID lookup.
- Security descriptor construction, DACL canonicalization, file-backed policy storage, or legacy NetAccess migration.
The immediate focus is server authorization or auditing that calls CoQueryClientBlanket but cannot retrieve authentication service, principal, level, capabilities, or identity.
What to verify
Verify that the call context is active and secured, and blanket querying occurs before asynchronous handoff or method return. That condition determines whether the same object can continue, a new object is required, or policy must change.
Difference from nearby HRESULTs
It concerns binding metadata; CO_E_FAILEDTOGETSECCTX is broader failure to obtain the server security context.
Correct handling and recovery
Inspect the binding and call timing, keep the query inside the server method, and reject identity-sensitive work when blanket details are unavailable.
Practical scenario
A server queues authorization to a worker then queries the client blanket there. It captures the approved blanket fields during the original call.
References
Looking for a different code? Search another status or error code.