| Previous | Next |
| STATUS_CTX_SHADOW_DENIED | STATUS_CTX_INVALID_WD |
STATUS_CTX_WINSTATION_ACCESS_DENIED
Session-object access was denied to the requesting process
STATUS_CTX_WINSTATION_ACCESS_DENIED means that a process asked to access a Terminal Services session without the rights required for that session object. It does not by itself say that the user was denied an inbound RDP sign-in; the failing operation may be query, management, token, or remote-control related.
The useful boundary is the caller token and requested session operation. Granting broad administrator rights can hide a wrong target, an unnecessary privilege request, or an application that should have used a narrower supported API.
Useful evidence
- Record the caller identity, integrity/elevation context, requested session ID, API, and desired access before changing group membership or policy.
- Check whether the session belongs to the expected host and user; a stale or broker-routed ID may turn an expected operation into an access problem.
- Apply the smallest appropriate RDS or session permission after confirming the required operation, rather than treating all RDS access failures as logon authorization errors.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: Remote Desktop Services API functions
- Microsoft: troubleshoot RDS access denied and authorization
Looking for a different code? Search another status or error code.