Troubleshooting ImpersonateSecurityContext in RING_BUFFER_SECURITY_ERROR

Question: In the RING_BUFFER_SECURITY_ERROR recordset , I see a recurring message , with CallingAPIName = NLShimImpersonate

APIName = ImpersonateSecurityContext,

ErrorCode = 0x139F

Is this an error?

Answer: Firstly, one of the main reasons for the RING_BUFFER_SECURITY_ERROR is to assist in finding information about login failures and other similar errors. Not all information found in this ring buffer indicates errors, some of them are informational.

 What does the 0x139F error code mean? To obtain a useable value you have to convert these error code into decimal value, which will be 0x139F = 5023.

The error message 5023 details are:

“The group or resource is not in the correct state to perform the requested operation”

According to Microsoft documentation “The ImpersonateSecurityContext function allows a server to impersonate a client by using a token previously obtained by a call to AcceptSecurityContext (General) or QuerySecurityContextToken. This function allows the application server to act as the client, and thus all necessary access controls are enforced.”

Basically this function is called when impersonation is required. To do so, there must already be a valid context handle.

Analyse error logs to identify Login failures and report on the state number.

Some reasons I've spotted are:

1) A service (set as Local System) on a server attempting to log on to SQL Server and not having access

2) IP registered on the DNS server with the same FQDN

Read More on Ring Buffer methods

Troubleshoot SQL Security Error Ring Buffer Recorded -

SQL Server – Troubleshoot connectivity issues with Connectivity Ring Buffer