What does HRESULT 0x80040E6E (SEC_E_NOOWNER) mean?

 
Previous Next
SEC_E_INVALIDOBJECT SEC_E_INVALIDACCESSENTRYLIST

SEC_E_NOOWNER

Exact value and result class

SEC_E_NOOWNER has unsigned value 2147749486 (0x80040E6E) and signed 32-bit value -2147217810. AllStat describes it as “Object does not have an owner”. In this result, a security query expects an owner but the target object has no owner defined by the provider.

The high bit is set, so this result is a failure HRESULT. Its facility is 4 (FACILITY_ITF) and its low code is 3694 (0x0E6E). These fields identify an interface-defined result family; they do not identify the provider instance, method, object generation or partial effects.

Evidence to collect

A useful this result event records provider CLSID and version, process architecture, interface IID and method, object correlation ID, transaction state and the immediately preceding HRESULT. When recording it data involving SIDs, account names, groups, ACL contents and protected object identifiers, use types, lengths, hashes or redacted identifiers rather than secrets or complete business data.

  • Evidence 1 for this HRESULT: object type and identifier.
  • Evidence 2 for this HRESULT: provider owner/group response.
  • Evidence 3 for this HRESULT: creation and ownership-change history.

Contract boundary

OLE DB security administration represents trustees, owners, groups, protected objects and access-entry lists as separate entities. A syntactically valid trustee can still be unknown to a provider, and an allowed permission set depends on the protected object type.

Investigation of this result should start with the provider security interface, effective data-source namespace and exact trustee or access-entry structure supplied. Capture it before ADO, ATL,.NET or a database abstraction layer replaces the native HRESULT with a generic exception.

Conditions that specifically lead to it

  • Cause 1 for this HRESULT: the object type does not require ownership.
  • Cause 2 for this HRESULT: the object was created without an owner.
  • Cause 3 for this HRESULT: provider metadata is incomplete or ownership was removed.

Diagnostic sequence

  1. Capture raw 0x80040E6E and symbolic it at the native call boundary.
  2. Identify the exact failing stage for this HRESULT: a security query expects an owner but the target object has no owner defined by the provider.
  3. Retrieve all OLE DB error records for this HRESULT before another COM call replaces thread error information.
  4. Compare the live object state and provider-granted capabilities with the input that produced it.
  5. Reduce the operation to the smallest case that preserves the same security contract.
  6. Apply one evidence-backed correction for this HRESULT and verify that the result is not merely replaced by a neighboring HRESULT.

Corrective actions

  • Action 1 for this HRESULT: treat no owner as a distinct supported state where documented.
  • Action 2 for this HRESULT: assign an owner through the provider interface when required.
  • Action 3 for this HRESULT: repair provider metadata only with an authoritative ownership source.

Practical scenario

An audit exporter assumes every object has an owner; representing ownerless objects explicitly prevents repeated failures. Keeping it with the method and object state makes this scenario diagnosable instead of reducing it to “database error”.

Developer and operations guidance

Code handling it should release COM objects in ownership order, retain per-row, per-column or per-property statuses, and log granted capabilities rather than only requested options. While handling it, opaque values such as HACCESSOR, HROW, HCHAPTER, DBID components and provider handles must remain scoped to the object that issued them.

Operational dashboards for this HRESULT should group by provider version, interface, method and normalized failure stage. A telemetry event must not expose passwords, tokens, full connection strings, unrestricted command text or raw row contents.

Retry and recovery

Retry rule for this HRESULT: retry the owner-dependent operation after a valid owner has been assigned. A retry is safe only when the relevant input, object generation, capability or external state has changed. Before replaying a modifying call that returned it, determine whether rows, schema objects or URL resources were partially created or changed.

Do not turn it into an unbounded retry loop. Preserve cancellation for this HRESULT and use a fresh provider object when the failed call may have left local state ambiguous.

Difference from nearby HRESULT values

SEC_E_INVALIDOWNER rejects a supplied owner trustee, while it reports that the object currently has none. Telemetry and remediation for this HRESULT should keep these outcomes distinct.

Official Microsoft references

Looking for a different code? Search another status or error code.