| Previous | Next |
| STATUS_LPAC_ACCESS_DENIED | STATUS_APP_DATA_NOT_FOUND |
STATUS_ADMINLESS_ACCESS_DENIED
The request assumes an administrator capability that is unavailable
This status is associated with an adminless security model, where an operation cannot rely on a conventional local administrator token or elevation path. It should not be handled as a prompt to disable security controls. The failing component must determine whether the operation has an alternative that can be authorized through a service, capability, policy, or ownership model.
The diagnostic distinction is between an ordinary ACL denial and a design that fundamentally requires administrator authority. Retrying with the same token, changing file ownership blindly, or granting Everyone full control can hide the symptom while breaking the intended security boundary.
What to inspect
- Record the API, target resource, requested access, effective token, integrity level, and package or capability SIDs.
- Determine whether the operation contract explicitly requires administrator authority or supports a brokered service.
- Check policy and deployment assumptions for devices configured without a usable local administrator workflow.
- Redesign privileged work as a narrow authenticated service operation rather than widening resource ACLs.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft Windows SDK metadata: ntstatus.h
- Microsoft: launch an AppContainer
- Chromium: Windows sandbox and LPAC design
Looking for a different code? Search another status or error code.