0xC000035C
NTSTATUS: 0xC000035C
Constant name:
STATUS_NETWORK_SESSION_EXPIRED
Meaning:
The network session has expired.
The client must re-authenticate with the server.
Typical Cause in SMB2
This status is returned by the SMB server when:
The Kerberos or NTLM session has expired (ticket lifetime ended or session token invalidated).
The SMB session was idle too long, and the server purged it from memory.
The server rebooted, or session table was lost, but the client still tries to use the old SessionId.
The Kerberos ticket expired (commonly 10 hours default in AD).
Example Context in SMB2 Trace
You may see this during:
SMB2 TREE_CONNECT or READ or WRITE
→ STATUS_NETWORK_SESSION_EXPIRED (0xC000035C)
Meaning:
The session handle in the SMB2 header (SessionId) is no longer valid on the server.
Client must initiate a new SMB2 Session Setup (re-authenticate) before continuing.
Common Scenarios and Fixes
| Cause | Description | Fix |
| --------------------------------------- | ------------------------------------------------------------- | ------------------------------------------------ |
| **Kerberos ticket expired** | Kerberos TGT or service ticket lifetime exceeded | Client automatically renews ticket or reconnects |
| **Server session timeout** | Server cleaned up idle sessions (e.g., after 15 minutes idle) | Ensure keep-alives or reconnect on expiration |
| **Server rebooted** | All sessions lost | Client reconnects automatically |
| **SMB session reused after disconnect** | Old session ID no longer valid | Trigger new Session Setup sequence |