Windows Stop Code CORRUPT_ACCESS_TOKEN (0x00000028): Meaning and Troubleshooting

Quick Answer

CORRUPT_ACCESS_TOKEN is Windows bug check 0x00000028. Microsoft says it occurs very infrequently and recommends the WinDbg !analyze extension to help determine the root cause. Its dedicated page does not define the four bug-check parameters, identify a specific corruption mechanism, or provide a universal fix. Microsoft Learn

The name concerns a Windows security access token, but it does not prove that an account was compromised or that a password was stolen. For a real crash, preserve the dump, examine the stack and token-related context, and establish which component altered or encountered the invalid state.

What Is an Access Token?

A Windows access token represents security information used when Windows evaluates what a process or thread is allowed to do. It is an internal operating-system object, distinct from a password, a website session token, or a cloud API key.

The symbolic name CORRUPT_ACCESS_TOKEN suggests that Windows encountered an invalid token state. However, Microsoft’s dedicated 0x28 page does not describe which token field was corrupt, how it became corrupt, or whether the corruption originated in the code currently running. Treat the stop-code name as a debugging lead, not a complete diagnosis. Microsoft Learn

Stop Code at a Glance

Does “Corrupt” Mean a Security Breach?

No conclusion about a breach follows from this stop code alone. “Corrupt” in a kernel bug-check name describes an invalid data state; the official 0x28 page does not attribute it to malware, credential theft, or an attacker. It also does not rule those possibilities in or out for an individual computer. Microsoft Learn

Likewise, this code is not an instruction to reset every password, delete a Windows profile, or change account permissions. Make security decisions from separate evidence, such as confirmed unauthorized activity or a trusted security investigation.

What Might an Investigator Look For?

Because Microsoft does not publish a 0x28-specific cause list, these are questions to answer from the dump, not asserted causes:

• Which thread and process context were active when Windows stopped?
• Was the code accessing or changing a token?
• Did a third-party kernel driver appear in the relevant stack?
• Was the apparent token state already invalid before the final operation?
• Do repeated crashes point to the same code path?
• Did crashes start after a driver or security-software change?

A driver named in a short automated analysis may have encountered a corrupt object rather than created it. Inspect the full stack and related object state before assigning responsibility.

How to Investigate the Crash in WinDbg

1. Verify the exact stop code

Confirm 0x00000028 in the original crash record or dump. Other bug checks may have similar names or parameter values; do not use their parameter tables for 0x28.

2. Preserve the crash dump

Keep the dump produced at the time of the failure. A screenshot gives the name but usually lacks the call stack, loaded modules, and object context needed to determine what happened.

3. Run the initial analysis

Open the dump in WinDbg and enter:

!analyze -v

Record the bug-check code, four argument values, stack trace, and any suggested module. Microsoft specifically recommends !analyze for 0x28. Its output is a starting point, not a guaranteed identification of the component that originally damaged an object. Microsoft Learn

4. Examine the stack

Use a detailed stack display:

kv

Look for token-handling, process, thread, or security-related operations along the execution path. Compare several dumps when available to see whether the same driver and operation recur.

5. Inspect a token only when you have a valid address

WinDbg provides a !token extension for examining token information. Use it only with an address established from the particular dump and debugger context. Microsoft’s 0x28 page does not say that any fixed bug-check argument contains a token address, so do not pass Arg1 or another argument to !token by assumption. Microsoft Learn

6. Correlate with changes and events

Review driver and security-product changes made before the first crash, along with nearby events in Event Viewer → Windows Logs → System. A recent change can focus the investigation, but a timing match alone is not proof.

Guidance for Driver Developers

If a driver you maintain appears in the relevant execution path, examine its handling of process or thread contexts and any referenced security objects. Check object lifetime, reference management, concurrency, and cleanup paths that the actual stack implicates.

Do not “repair” the situation by editing an internal access-token structure based on the symbolic name. The right change depends on identifying the first invalid operation and following the documented APIs for the object involved. Microsoft’s dedicated 0x28 page does not define a particular token field or write that causes this bug check. Microsoft Learn

Guidance for End Users

If the blue screen occurs repeatedly:

1. Save the dumps and record when each crash occurred.
2. Note recent changes to drivers, devices, and security software.
3. Have a dump analysed to identify a relevant component.
4. Use a vendor-supported update or rollback if the evidence points consistently to a third-party driver.

Do not delete a user account, reset Windows security settings, or reinstall Windows solely because the error contains “ACCESS_TOKEN.” Microsoft provides no such code-specific recommendation. Microsoft Learn

Frequently Asked Questions

What is CORRUPT_ACCESS_TOKEN?

It is the symbolic name for Windows bug check 0x00000028. Microsoft says it appears very infrequently. Microsoft Learn

Does it mean someone stole my login token?

The official 0x28 reference does not make that claim. A crash label alone cannot establish a security breach. Microsoft Learn

What do the four parameters mean?

Microsoft’s dedicated 0x28 page does not define them. Record their values, but do not assume one is a token pointer without corroboration from the dump. Microsoft Learn

Is this a browser or website access-token error?

No. This is a Windows bug-check code, not an HTTP authentication or cloud API error.

Which driver should I update?

The stop code does not name a driver. Use the crash stack, repeated dumps, and change history to identify a supported driver lead.

What does !token do?

It is a WinDbg extension for examining token information. It can help when the debugger has established a valid token address, but Microsoft’s 0x28 reference does not map a bug-check parameter to that address. Microsoft Learn

Summary

CORRUPT_ACCESS_TOKEN (0x00000028) is a very rare Windows bug check with limited official diagnostic detail. It should prompt investigation of the actual kernel dump and execution path. The name does not establish a compromised account, identify a faulty driver, or justify a universal repair. Begin with !analyze -v, inspect the stack, and act on the evidence found. Microsoft Learn

Sources

• Microsoft Learn: Bug Check 0x28 — CORRUPT_ACCESS_TOKEN
• Microsoft Learn: !analyze WinDbg extension
• Microsoft Learn: !token WinDbg extension