| Previous | Next |
| CO_E_NETACCESSAPIFAILED | CO_E_INVALIDSID |
CO_E_WRONGTRUSTEENAMESYNTAX
Trustee name has invalid domain and account syntax
CO_E_WRONGTRUSTEENAMESYNTAX is HRESULT 2147549484 (0x8001012C) from winerror.h. The documented description is “One of the trustee strings provided by the user did not conform to the <Domain>\<Name> syntax and it was not the "*" string.” The relevant context is the COM IAccessControl, DCOM client identity, trustee translation, token inspection, security descriptor, ACL, or serialization workflow.
What to verify
Verify that the input encoding, separator, domain, account, escaping, and intended trustee type are validated before lookup.
Where it is encountered
- IAccessControl initialization, access checks, owner/trustee processing, and serialized ACL persistence.
- Server-side DCOM impersonation, client blanket inspection, token and SID lookup.
- Security descriptor construction, DACL canonicalization, file-backed policy storage, or legacy NetAccess migration.
The immediate focus is a trustee string that is neither the accepted wildcard nor a supported Domain\Name principal form.
Correct handling and recovery
Normalize through an identity-aware parser, reject ambiguous display names, and prefer SID-based persistence after a trusted lookup.
Difference from nearby HRESULTs
It is parser-level; CO_E_NOMATCHINGSIDFOUND is a well-formed name that cannot be resolved.
Practical scenario
A policy import uses an email-style user principal name where the legacy interface requires DOMAIN\user. Import translates through a verified directory lookup.
References
Looking for a different code? Search another status or error code.