Fix ERROR_NO_IMPERSONATION_TOKEN (0x0000051d) in Windows

Quick answer

Grant the process or service account the SeImpersonatePrivilege right, or ensure the calling thread has a valid impersonation token via ImpersonateLoggedOnUser or SetThreadToken.

Why you're seeing this

This error code (0x0000051d) translates to ERROR_NO_IMPERSONATION_TOKEN. It shows up when a thread tries to impersonate a user but doesn't have an active impersonation token. Common triggers: a Windows service running as LOCAL SYSTEM or NETWORK SERVICE trying to access a network share, an IIS application pool impersonating a specific user, or a custom app calling ImpersonateSelf without first enabling the privilege. The underlying cause is almost always a missing or revoked SeImpersonatePrivilege for the process's security context.

Fix steps

1. Check the process token privileges. Open an admin command prompt and run whoami /priv under the account that hosts the failing process. Look for SeImpersonatePrivilege. If it says Disabled, the privilege exists but the thread didn't enable it. If it's missing entirely, you need to grant it.
2. Grant SeImpersonatePrivilege via Local Security Policy. Go to secpol.msc > Local Policies > User Rights Assignment. Find Impersonate a client after authentication. Add the service account (e.g., NT AUTHORITY\NETWORK SERVICE) or the specific domain account. Reboot or run gpupdate /force.
3. Verify the thread token. If you wrote the code, check that ImpersonateLoggedOnUser or SetThreadToken is called with a valid token handle. A NULL token handle will trigger this exact error. Use GetLastError() after the impersonation call to confirm success.

Alternative fixes if the above fails

• Switch the service account to LOCAL SYSTEM. This account has SeImpersonatePrivilege by default. In services.msc, change the service's Log On account to Local System. Restart the service. Not ideal for network access, but works for local resources.
• Use CoImpersonateClient correctly in COM. If this error pops up in a COM component, ensure the client proxy is set up with EOAC_DYNAMIC_CLOAKING or EOAC_STATIC_CLOAKING. Missing cloaking flags are a classic trap.
• Update to the latest Windows cumulative update. I've seen a 2024 patch for Server 2022 fix an issue where SeImpersonatePrivilege wasn't honored for certain NETWORK SERVICE threads. Check KB5034129 or later.

Prevention tip

Always run services under the least privilege account that still has SeImpersonatePrivilege. For most setups, NT AUTHORITY\NETWORK SERVICE is fine — just verify the privilege is present after any patching or group policy changes. If you're writing a service that impersonates users, explicitly enable the privilege with AdjustTokenPrivileges before calling impersonation functions. And never assume a token handle is valid — check it.

Don't bother tweaking registry keys like HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\DisableTokenEnforcement — that rarely helps and can open security holes.