| Previous | Next |
| STATUS_REPARSE_ATTRIBUTE_CONFLICT | STATUS_FLOAT_MULTIPLE_FAULTS |
STATUS_CANT_ENABLE_DENY_ONLY
A deny-only SID cannot grant access again
In a restricted token, a deny-only SID is considered for access-denied ACEs but ignored for access-allowed ACEs. Windows does not permit AdjustTokenGroups to turn it back into an enabled granting SID, because doing so would defeat the security boundary established when the restricted token was created.
Create a new token from an authorized source if a different identity is required. Do not use token adjustment as a privilege-escalation mechanism. When diagnosing access denial, remember that the SID can still trigger a deny ACE even though it cannot grant access.
What to inspect
- Query token groups and locate SE_GROUP_USE_FOR_DENY_ONLY.
- Trace where the restricted token was created and which SIDs were disabled.
- Perform the operation under a separately authorized token rather than attempting to re-enable the SID.
References
- Microsoft: SID attributes in an access token
- Microsoft: CreateRestrictedToken
- Microsoft: AdjustTokenGroups
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.