What does Windows error code 1346 (ERROR_BAD_IMPERSONATION_LEVEL) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: ERROR_BAD_IMPERSONATION_LEVEL either a required impersonation level was not provided, or the provided impersonation level is invalid.

Previous	Next
ERROR_INVALID_GROUP_ATTRIBUTES	ERROR_CANT_OPEN_ANONYMOUS

ERROR_BAD_IMPERSONATION_LEVEL

ERROR_BAD_IMPERSONATION_LEVEL (1346, 0x00000542) means that a client token does not provide the level of impersonation required by the operation. The problem is the token's permitted capability, not simply whether a token exists.

Impersonation levels define what a server may do

SecurityIdentification lets a server inspect the client's identity and privileges for access decisions, but it does not allow the server to act as that client. SecurityImpersonation allows local impersonation, while SecurityDelegation can support acting on behalf of the client on remote systems. Anonymous and identification-level tokens cannot be used where true impersonation is required.

Where to look

Read TokenImpersonationLevel with GetTokenInformation for the token actually being used.
For named pipes, RPC, DDE, or COM, check the client and server security settings that establish the requested level.
Do not silently substitute the service's own identity for the client identity without an explicit authorization decision; that can perform work with broader rights than intended.
Handle the case where only identity inspection is available and the requested work requires impersonation.

See Microsoft documentation for impersonation levels and ImpersonateLoggedOnUser.

Looking for a different code? Search another status or error code.