| Previous | Next |
| STATUS_NO_IMPERSONATION_TOKEN | STATUS_NO_LOGON_SERVERS |
STATUS_CANT_DISABLE_MANDATORY
A mandatory SID cannot be disabled with AdjustTokenGroups
Mandatory token groups are protected from ordinary enable/disable adjustment. The rule prevents a caller from removing identity components that the token construction path designated as required. The user SID also cannot be disabled through AdjustTokenGroups.
If reduced privileges are required, create a restricted token and deliberately convert selected SIDs to deny-only where supported. Do not edit TOKEN_GROUPS memory or retry with the same flags; access checks depend on the invariant that mandatory groups remain represented.
What to inspect
- Identify the SID and confirm SE_GROUP_MANDATORY is set.
- Use a restricted-token design when sandboxing requires reduced group authority.
- Re-run effective-access tests because deny-only SIDs still participate in deny ACEs.
References
- Microsoft: TOKEN_GROUPS
- Microsoft: SID attributes in an access token
- Microsoft: AdjustTokenGroups
- Microsoft: CreateRestrictedToken
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.