| Previous | Next |
| SEC_E_BADTRUSTEEID | SEC_E_NOMEMBERSHIPSUPPORT |
SEC_E_NOTRUSTEEID
Meaning
Windows documents SEC_E_NOTRUSTEEID as “Trustee was not recognized for this data source”. In this case, the provider accepts the trustee format but cannot resolve that trustee in the data-source security namespace.
Relevant contract
OLE DB security administration represents trustees, owners, groups, protected objects and access-entry lists as separate entities. A syntactically valid trustee can still be unknown to a provider, and an allowed permission set depends on the protected object type.
Investigation of this result should start with the provider security interface, effective data-source namespace and exact trustee or access-entry structure supplied.
Evidence to collect
When recording diagnostic data involving SIDs, account names, groups, ACL contents and protected object identifiers, use types, lengths, hashes or redacted identifiers rather than secrets or complete business data.
- Evidence 1: normalized trustee identifier and authority.
- Evidence 2: provider lookup result and data-source domain.
- Evidence 3: deployment or directory changes affecting the identity.
Conditions that specifically lead to it
- Cause 1: the account or group does not exist in the provider domain.
- Cause 2: a name is valid but qualified for the wrong authority.
- Cause 3: the trustee was deleted after policy was exported.
Diagnostic sequence
- Identify the exact failing stage: the provider accepts the trustee format but cannot resolve that trustee in the data-source security namespace.
Retry and recovery
Retry rule: retry after creating, mapping or selecting a trustee recognized by the target data source.
Corrective actions
- Action 1: resolve trustees against the target provider before applying ACLs.
- Action 2: use stable identifiers where the provider supports them.
- Action 3: handle missing principals as deployment drift rather than malformed input.
Practical scenario
A policy copied between environments names a group absent in the destination; mapping it to the destination group resolves the result.
Difference from nearby HRESULT values
SEC_E_BADTRUSTEEID reports malformed identity data, while SEC_E_NOTRUSTEEID reports a well-formed but unknown trustee.
Official Microsoft references
Looking for a different code? Search another status or error code.