| Previous | Next |
| STATUS_DEVICE_NOT_READY | STATUS_BAD_IMPERSONATION_LEVEL |
STATUS_INVALID_GROUP_ATTRIBUTES
The token group flags do not form a legal state
Group SIDs can be enabled, mandatory, owner-capable, integrity SIDs, resource groups, logon IDs, or deny-only. Some combinations are mutually exclusive: a deny-only SID cannot also be enabled, and special compound bits such as SE_GROUP_LOGON_ID must be treated as defined values rather than arbitrary flags.
Dump every SID and attribute mask before modifying the token. Avoid copying group flags from directory or application metadata into TOKEN_GROUPS without validation. Use the documented token APIs to create restricted tokens or adjust enabled groups instead of editing packed token structures.
What to inspect
- Decode each attribute bit and identify unsupported combinations.
- Verify array length and SID_AND_ATTRIBUTES alignment before the call.
- Use CreateRestrictedToken for deny-only conversion rather than constructing flags manually.
References
- Microsoft: TOKEN_GROUPS
- Microsoft: SID attributes in an access token
- Microsoft: CreateRestrictedToken
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.