| Previous | Next |
| STATUS_FULLSCREEN_MODE | STATUS_LOGON_TYPE_NOT_GRANTED |
STATUS_TOO_MANY_CONTEXT_IDS
Count SIDs in the resulting security context, not just visible direct group memberships
STATUS_TOO_MANY_CONTEXT_IDS is a concrete access-token construction limit. Microsoft documents that the array of group SIDs in an access token can contain no more than 1,024 SIDs and that failures can appear when a user is an explicit or transitive member of roughly 1,010 or more security groups because LSA also inserts well-known SIDs. SIDHistory values contribute as well.
The count is context-dependent. Domain-local groups can differ by resource domain, server-local groups can affect one server, and logon type changes which SIDs are present. That explains why the same account may log on to one machine but fail on another. This status is also distinct from Kerberos ticket-size problems such as MaxTokenSize; Microsoft explicitly notes that Kerberos versus NTLM does not change the access-token SID limit.
Use group-membership evaluation to find high-leverage nesting and SIDHistory chains. Remove memberships only after confirming authorization requirements. Converting a truly authorization-bearing security group to a distribution group merely to reduce the count can remove access, so the group graph and ACL usage must be reviewed together.
What to inspect
- Explicit and transitive security-group memberships, SIDHistory on the user and groups, and server-local memberships.
- The logon type and resource domain where failure occurs, compared with a machine where the same account succeeds.
- Groups with deep nesting or multiple SIDHistory values that add many SIDs to the final token.
References
- Microsoft: Logon failure with more than about 1,010 groups
- Microsoft: Access tokens
- Microsoft: Security identifiers
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.