| Previous | Next |
| TRUST_E_ACTION_UNKNOWN | TRUST_E_SUBJECT_NOT_TRUSTED |
TRUST_E_SUBJECT_FORM_UNKNOWN
TRUST_E_SUBJECT_FORM_UNKNOWN identifies a failure in trust subject representation. The chosen trust provider recognizes the action but not the WINTRUST_DATA union choice or subject form supplied for the object. Diagnose trust subject representation at the first component that returned the value, not the last user-interface layer that displayed it; later cleanup and fallback attempts can produce different secondary errors.
Where the status is selected
For TRUST_E_SUBJECT_FORM_UNKNOWN, WinVerifyTrust dispatches by an action GUID to a trust provider and then interprets the subject through the WINTRUST_DATA union choice. Provider installation, action support, and subject form are separate contracts; capture both the GUID and the union member selected by dwUnionChoice when TRUST_E_SUBJECT_FORM_UNKNOWN is returned.
Evidence that changes the diagnosis
- Action GUID and installed provider capable of handling it
Record dwUnionChoice and the corresponding WINTRUST_FILE_INFO, CATALOG_INFO, BLOB_INFO, CERT_INFO, or SIGNER_INFO structure.
Identifies the trust action, subject representation, and signer state when TRUST_E_SUBJECT_FORM_UNKNOWN is returned. - WINTRUST_DATA structure size, union choice, subject fields, and state-action flags
Initialize cbStruct fields and ensure the selected union pointer matches the choice.
Separates signature decoding, certificate selection, and final policy when TRUST_E_SUBJECT_FORM_UNKNOWN is returned. - A known-good subject verified with the same action and a known action for the same subject
Check whether the action supports files, catalogs, blobs, certificates, or signer structures.
Prevents success under a different trust action from masking the original failure when TRUST_E_SUBJECT_FORM_UNKNOWN is returned.
Correlate the failure with state changes
Trust verification is a pipeline, not one Boolean check in a trust subject representation investigation. For TRUST_E_SUBJECT_FORM_UNKNOWN, align artifact acquisition, signature decoding, signer selection, countersignature or timestamp processing, chain construction, revocation retrieval, and final action policy. Preserve provider state before closing it so the generic top-level result can be connected to the stage that actually rejected the subject when TRUST_E_SUBJECT_FORM_UNKNOWN is returned.
- Original signed artifact or catalog identity and the exact WinVerifyTrust action and flags when TRUST_E_SUBJECT_FORM_UNKNOWN is returned.
- In the TRUST_E_SUBJECT_FORM_UNKNOWN path, signer, countersigner, timestamp, chain, revocation, and nested provider results.
- For TRUST_E_SUBJECT_FORM_UNKNOWN, verification from a second tool configured to apply equivalent policy, not merely a signature-only check.
A controlled way to reproduce it
First call the documented standard action with its documented subject form when TRUST_E_SUBJECT_FORM_UNKNOWN is returned. In the TRUST_E_SUBJECT_FORM_UNKNOWN path, then change only the action GUID or union choice to match the production integration. This PINpoints dispatch versus subject representation in a trust subject representation investigation.
| Test | Interpretation |
|---|---|
| Same input, known-good path | For trust subject representation, success moves attention toward the selected provider, policy, device, context, or transaction state. |
| Known-good input, failing path | For trust subject representation, failure suggests that the environment or selected object is independently unable to perform the operation. |
| Original path after one isolated change | For trust subject representation, this comparison demonstrates whether the proposed correction addresses the original condition. |
Nearby results and misleading fixes
TRUST_E_ACTION_UNKNOWN means no suitable action provider; this code means the provider does not accept the selected subject representation. Trying random action GUIDs until one returns success changes the trust policy being asked, not merely the mechanism used to answer it in a trust subject representation investigation.
For trust subject representation, also retain the original numeric value; neighboring constants can encode materially different remediation paths even when an application presents all of them as an authentication, certificate, or security failure.
What counts as a real resolution
The intended action must be handled by the intended provider using a supported subject form, and state data must be closed according to the API contract when TRUST_E_SUBJECT_FORM_UNKNOWN is returned. For TRUST_E_SUBJECT_FORM_UNKNOWN, keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.
Technical references
For TRUST_E_SUBJECT_FORM_UNKNOWN, these sources define the HRESULT and the relevant trust subject representation interface, protocol, or data format.
- Microsoft Open Specifications: HRESULT values.
- Microsoft: WinVerifyTrustEx.
- Microsoft: WINTRUST_DATA.
- RFC 5652: Cryptographic Message Syntax.
Looking for a different code? Search another status or error code.