What does NTSTATUS 0xC0000105 (STATUS_LOGON_SESSION_COLLISION) mean?

STATUS_LOGON_SESSION_COLLISION

Authentication-package session creation collided

This is an internal LSA/authentication-package consistency error. A package requested a logon session whose identifier or state collides with an existing session.

The useful troubleshooting target is the package/session path, not the end-user credential alone. It can appear after partial failures, duplicate callbacks, or cleanup ordering bugs.

What to inspect

• Record the authentication package name and the logon type.
• Check for repeated session creation after timeout or retry.
• Correlate with LSA and security event log entries around the same LUID.

Capture the LUID and authentication package at the first collision. If the identifier was generated locally, verify its allocation rules; if it was supplied externally, trace why an existing session identifier was reused.

References

• Microsoft: Kerberos authentication troubleshooting guidance
• Microsoft: Access tokens
• Microsoft Open Specifications: NTSTATUS values