What's the meaning of the error value 0x16f returned by the GetLastError() function

Question

When I call the function CreateProcessAsUser(), it returns a failure.
And then the call to GetLastError() to check why the error occurred returns the value 0x16f.

I couldn't find out what the error is supposed to mean.

Answer 1

ERROR_CHILD_PROCESS_BLOCKED is converted NTSTATUS - STATUS_CHILD_PROCESS_BLOCKED (0xC000049D) - I search in ntoskrnl.exe and found that this code referenced only from 2 place when NtCreateUserProcess called - from SeSubProcessToken and for log error:

NtCreateUserProcess
  PspAllocateProcess
    PspInitializeProcessSecurity
      SeSubProcessToken
        if (!SeTokenIsNoChildProcessRestricted(Token))
        {
            status = STATUS_CHILD_PROCESS_BLOCKED;
        }


  if (PspAllocateProcess() == STATUS_CHILD_PROCESS_BLOCKED)
  {
    EtwTraceDeniedTokenCreation();
  }

so when SeTokenIsNoChildProcessRestricted(Token) return FALSE you can got ERROR_CHILD_PROCESS_BLOCKED from CreateProcess.

this is new api, exist only from 1607 build of win10

#if (NTDDI_VERSION >= NTDDI_WIN10_RS1)
NTKERNELAPI
BOOLEAN
SeTokenIsNoChildProcessRestricted(
    _In_ PACCESS_TOKEN Token
    );// return (Token->TokenFlags & 0x80000) != 0;
#endif

declared in ntifs.h but not documented.

so process, which fail call CreateProcessAsUser is somehow restricted. Windows Store sandbox , as how Harry Johnston guess ?