| Previous | Next |
| STATUS_BAD_VALIDATION_CLASS | STATUS_BAD_MASTER_BOOT_RECORD |
STATUS_BAD_TOKEN_TYPE
Primary and impersonation tokens were used in the wrong place
Windows distinguishes primary tokens, which are associated with processes, from impersonation tokens, which a server thread can use temporarily. This status indicates that the token object exists but is the wrong kind for the requested operation.
The fix is usually to create or duplicate the correct token type with the right access rights and impersonation level, not to retry the same handle.
What to inspect
- Check whether a process-creation path received an impersonation token instead of a primary token.
- Check whether an impersonation path received a primary token where an impersonation token was required.
- Inspect DuplicateTokenEx parameters and token access masks.
References
- Microsoft: Access tokens
- Microsoft: Impersonation tokens
- Microsoft: Access rights for access-token objects
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.