| Previous | Next |
| STATUS_ALREADY_COMMITTED | STATUS_BUFFER_TOO_SMALL |
STATUS_ACCESS_DENIED
The access check did not grant the requested mask
Windows evaluates the caller token against the object security descriptor, including deny and allow ACEs, privileges, restricted SIDs, integrity policy, and object-specific rights. The status therefore identifies a failed authorization decision, not a generic instruction to run the program as administrator.
Capture the exact desired access mask and the token used for the check. A request for excessive rights such as GENERIC_ALL can fail even when the operation only needs read access. Also distinguish the process primary token from an impersonation token and check whether mandatory integrity control or a deny-only SID affected the result.
What to inspect
- Record the object type, desired access mask, granted access, and token identity.
- Inspect deny ACE ordering, restricted SIDs, integrity level, and required privileges.
- Retry only with the minimum rights actually needed by the operation.
References
- Microsoft: AccessCheck
- Microsoft: Access control model
- Microsoft: Access tokens
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.