How to fix Error 1346 on Windows 11

by

Windows 11 Error 1346: Impersonation Level Error Troubleshooting Guide

Why This Error Happens

Error 1346 occurs when a COM/DCOM or WMI client application attempts to connect to a remote service without specifying the correct impersonation level, typically because the required level is either missing or set to “Anonymous” instead of “Identify” or “Impersonate.” This is frequently caused by misconfigured DCOM security settings in the registry, corrupted user profile permissions, or scripts (like WMI/VBScript queries) that fail to explicitly define the impersonationLevel parameter. Additionally, Group Policy restrictions on remote access can strip the necessary security tokens needed to authenticate the request.

Step-by-Step Resolution Guide

Step 1: Verify and Adjust DCOM Configuration Settings

  • Press Win + R, type dcomcnfg, and press Enter to open Component Services.
  • Navigate to Console Root > Component Services > Computers > My Computer.
  • Right-click My Computer, select Properties, and go to the Default Properties tab.
  • Ensure “Default Impersonation Level” is set to Identify (this is the standard secure default for Windows 11).

Step 2: Correct the WMI Script Impersonation Parameter

  • If the error stems from a custom script or third-party tool (common in monitoring software), locate the connection string in the script.
  • Ensure the moniker includes the correct impersonation flag. For example, in VBScript or WMI queries, verify the string includes: winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2
  • If using PowerShell, ensure the Get-WmiObject or Get-CimInstance cmdlet includes the -Impersonation Impersonate flag if required by the target server.

Step 3: Reset Local Security Policy for Network Access

  • Open the Local Group Policy Editor by typing gpedit.msc in the Run dialog.
  • Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
  • Locate the “Impersonate a client after authentication” policy and ensure the current user account or relevant service account (e.g., NETWORK SERVICE, LOCAL SERVICE) is listed.
  • Run gpupdate /force in Command Prompt (Admin) to apply the changes immediately.

Step 4: Check User Account Control (UAC) and Local Permissions

  • Open the Registry Editor (regedit) and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole.
  • Verify the LegacyImpersonationLevel DWORD value is set to 3 (Impersonate).
  • If the value does not exist, you may need to create it as a DWORD (32-bit) and set the value to 3, then restart the machine.

Alternative or Verification Steps

  • Verify the Fix: Re-run the specific application or script that triggered Error 1346. If it was a WMI query, test it via a simple PowerShell command like Get-CimInstance Win32_OperatingSystem -ComputerName "TargetPC" to confirm the connection completes without security errors.
  • Alternative Solution: If the error persists on a domain-joined machine, check if a Domain-level Group Policy is overriding the local settings; you may need to request an exception from your Network Administrator for the “Impersonate a client after authentication” right specifically for your user profile.