| Previous | Next |
| SL_E_SFS_INVALID_TOKEN_DESCRIPTOR | E_HANDLE |
E_ACCESSDENIED
E_ACCESSDENIED — 0x80070005
The short system message identifies the immediate outcome, but the useful interpretation is narrower: authorization at a COM or Win32 boundary. In this case, the callee rejected the caller token or an access/launch permission before the requested work could begin.
Meaning in the subsystem
COM activation is a sequence rather than a single operation: registration lookup, SCM or surrogate selection, process startup, class-factory publication, marshaling, and finally the requested interface call. The useful evidence is the evidence from the first stage that fails; a later RPC or cleanup message can otherwise hide the original activation problem.
Do not collapse this result into a nearby status. A missing object or invalid argument is not access denial; confirm that the target exists and that the request reached its authorization check. Compare lifecycle, identity, caller, and first API.
Minimum useful evidence
| Preserve before changing state | Diagnostic value |
|---|---|
| The effective user, integrity level, elevation state, impersonation level, and session | Tests whether the first boundary moves. |
| The object identity, CLSID/AppID or securable resource and the requested access mask | Pins evidence to one attempt. |
| COM launch/access permissions, service security descriptor, and any per-object ACL | Separates contract failure from environment. |
| The first failing API and the security event or Procmon access result at the same timestamp | Creates a stable before/after control. |
The goal is reproducibility, not a full data dump. Prefer object IDs, configuration exports, event correlation, and redacted paths over credentials, cryptographic material, or user content.
Isolate the responsible condition
- Repeat with the same binary under the intended production identity rather than an administrator account; use a disposable or backed-up environment when the comparison changes boot, security, device, queue, or encryption state.
- Compare local activation with remote activation while keeping CLSID and credentials fixed; retain one negative control so that a broad workaround is not mistaken for a root-cause correction.
- Temporarily grant only the exact missing right in a test environment and verify that the failure boundary moves; keep every other input fixed and record the first event that differs from the failing run.
Avoid the common misdiagnosis
Read the comparison results in this order:
| Observed result | Interpretation |
|---|---|
| The minimal or known-good comparison succeeds | The control works; inspect production-specific state. |
| The control fails at the same first operation | The control also fails; inspect host/provider evidence. |
| A new HRESULT marks another boundary | this condition moved; diagnose the new status separately rather than treating it as confirmation that the entire operation is fixed. |
Regression proof
Apply the smallest change that addresses the first rejected condition: Repair the launch/access ACL, service identity, file or registry permission that denies the documented operation; do not solve it by permanently running the whole client elevated. Preserve the pre-change configuration or trace.
Close the incident only when the original identity can complete the operation with least privilege, while a deliberately unprivileged control still receives access denied. Repeat under the original identity and state. A different environment is comparison, not proof.
Technical references
These references define the HRESULT family and subsystem contract used above:
- Microsoft Open Specifications: HRESULT values.
- Microsoft: COM clients and servers.
- Microsoft: CoGetClassObject.
- Microsoft: COM elevation moniker.
Looking for a different code? Search another status or error code.