| Previous | Next |
| ERROR_INVALID_LOGON_TYPE | ERROR_RXACT_INVALID_STATE |
ERROR_CANNOT_IMPERSONATE
The pipe server has not yet read the client message whose security context would be impersonated
ImpersonateNamedPipeClient changes the server thread to the security context of the client associated with the last message read from the pipe. The API therefore depends on the server having read client data first. This error identifies an ordering problem in the named-pipe protocol, not simply the absence of SeImpersonatePrivilege.
Trace connect, read, impersonate, request processing, and RevertToSelf on the same server thread. With overlapped I/O, ensure the read has actually completed before the impersonation call. Always check the return value: Microsoft warns that a failed impersonation leaves the thread in its previous process context, which can be more privileged than the client. Do not continue handling the client request after failure. If impersonation level or privilege is the problem, capture that separately after the message-read ordering is correct.
What to inspect
- Verify a client message was successfully read before impersonation.
- For overlapped pipes, wait for read completion rather than read submission.
- Abort client processing on impersonation failure and always pair success with RevertToSelf.
References
Looking for a different code? Search another status or error code.