What causes "Could not set proxy blanket." in java-native-access/jna?

Call CoInitializeSecurity once per process with RPC_C_AUTHN_WINNT, RPC_C_AUTHZ_NONE, RPC_C_AUTHN_LEVEL_CALL (or DEFAULT), RPC_C_IMP_LEVEL_IMPERSONATE before creating WMI connections — or don't call it at all so JNA's defaults apply.

java-native-access/jna · error · com.sun.jna.platform.win32.COM.COMException

Could not set proxy blanket.

Error message

Could not set proxy blanket.

What it means

After IWbemLocator::ConnectServer succeeds, connectServer calls CoSetProxyBlanket to set authentication (WINNT) and impersonation (IMPERSONATE) levels on the IWbemServices proxy. A failing HRESULT here releases the services and throws COMException "Could not set proxy blanket.", typically meaning the COM security settings are incompatible.

Source

Thrown at contrib/platform/src/com/sun/jna/platform/win32/COM/WbemcliUtil.java:543

            throw new COMException("Failed to create WbemLocator object.");
        }

        // Step 4: -----------------------------------------------------
        // Connect to WMI through the IWbemLocator::ConnectServer method
        // Connect to the namespace with the current user and obtain pointer
        // pSvc to make IWbemServices calls.
        IWbemServices services = loc.ConnectServer(namespace, null, null, null, 0, null, null);
        // Release the locator. If successful, pSvc contains connection
        // information
        loc.Release();

        // Step 5: --------------------------------------------------
        // Set security levels on the proxy -------------------------
        HRESULT hres = Ole32.INSTANCE.CoSetProxyBlanket(services, Ole32.RPC_C_AUTHN_WINNT, Ole32.RPC_C_AUTHZ_NONE, null,
                Ole32.RPC_C_AUTHN_LEVEL_CALL, Ole32.RPC_C_IMP_LEVEL_IMPERSONATE, null, Ole32.EOAC_NONE);
        if (COMUtils.FAILED(hres)) {
            services.Release();
            throw new COMException("Could not set proxy blanket.", hres);
        }
        return services;
    }

}

View on GitHub (pinned to d036ad9781)

Solutions

Call CoInitializeSecurity once per process with RPC_C_AUTHN_WINNT, RPC_C_AUTHZ_NONE, RPC_C_AUTHN_LEVEL_CALL (or DEFAULT), RPC_C_IMP_LEVEL_IMPERSONATE before creating WMI connections — or don't call it at all so JNA's defaults apply.
Ensure no other library in the process sets conflicting COM security; align all consumers on one setting.
Check the wrapped HRESULT in the COMException for the exact reason (e.g. E_ACCESSDENIED).
For remote WMI, verify credentials/domain and DCOM permissions (dcomcnfg).

Example fix

// before
// some framework already called:
Ole32.INSTANCE.CoInitializeSecurity(null, -1, null, null, Ole32.RPC_C_AUTHN_LEVEL_NONE, Ole32.RPC_C_IMP_LEVEL_IDENTIFY, null, Ole32.EOAC_NONE, null);
// after
Ole32.INSTANCE.CoInitializeSecurity(null, -1, null, null, Ole32.RPC_C_AUTHN_LEVEL_CALL, Ole32.RPC_C_IMP_LEVEL_IMPERSONATE, null, Ole32.EOAC_NONE, null);

Defensive patterns

Strategy: try-catch

Validate before calling

// ensure process-wide COM security is compatible before WMI use:
Ole32.INSTANCE.CoInitializeSecurity(null, -1, null, null,
    Ole32.RPC_C_AUTHN_LEVEL_CALL, Ole32.RPC_C_IMP_LEVEL_IMPERSONATE, null, Ole32.EOAC_NONE, null);

Try / catch

try {
    IWbemServices svc = WbemcliUtil.connectServer(ns);
} catch (COMException e) {
    if (e.getMessage().contains("proxy blanket")) { /* align CoInitializeSecurity settings or check credentials */ }
}

Prevention

Call CoInitializeSecurity exactly once with impersonate-level settings
Avoid mixing libraries that set conflicting COM security
For remote WMI, verify account, domain, and DCOM permissions

When it happens

Trigger: CoSetProxyBlanket returns a failure HRESULT — commonly because CoInitializeSecurity was already called with incompatible settings (e.g. impersonation level below RPC_C_IMP_LEVEL_IMPERSONATE or authentication level too low) for this process, or a previous connection changed proxy security.

Common situations: Application called CoInitializeSecurity earlier with different authn/imp levels; mixing libraries that each set process-wide COM security; remote WMI where the server rejects the requested authentication; running in restricted service accounts or containers.

Related errors

AI-assisted analysis of java-native-access/jna@d036ad9781 (2026-09-12). Data as JSON: /api/errors/072196b33895a9b6. Report an issue: GitHub.