| Previous | Next |
| STATUS_RUNLEVEL_SWITCH_IN_PROGRESS | STATUS_NOT_SUPPORTED_IN_APPCONTAINER |
STATUS_NOT_APPCONTAINER
The caller does not have an AppContainer security context
AppContainer is an orthogonal property of a Windows access token, not merely another integrity level. An AppContainer token carries a package or profile SID and capability SIDs used in access checks. This status means an API restricted to that model was invoked from an ordinary process or from a thread whose effective token lacks AppContainer information.
Launching the executable from a package directory does not prove that it runs in AppContainer. Packaged applications can use different trust levels, and unpackaged programs must explicitly create and launch with an AppContainer profile. The correct fix is usually in process creation or broker design, not an ACL that grants broad access to the ordinary caller.
What to inspect
- Query TokenIsAppContainer and TOKEN_APPCONTAINER_INFORMATION on the effective token used by the call.
- Check whether thread impersonation replaced an AppContainer process token with a non-AppContainer token.
- Verify package trust level, profile creation, SECURITY_CAPABILITIES, and process-launch attributes.
- Do not emulate AppContainer by only lowering integrity level; the token and capability model is different.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: AppContainer for legacy apps
- Microsoft: launch an AppContainer
- Microsoft: TOKEN_APPCONTAINER_INFORMATION
Looking for a different code? Search another status or error code.