| Previous | Next |
| STATUS_NO_LOG_SPACE | STATUS_LM_CROSS_ENCRYPTION_REQUIRED |
STATUS_TOO_MANY_SIDS
The SID list exceeds the receiving security contract
SID lists appear in access tokens, authorization data, group expansion, trust processing, and several native APIs. This status means the count cannot be represented or processed by the receiving component. It does not identify one particular SID as invalid.
Collect the expanded group and SID history data, because nested groups and cross-domain authorization can inflate the list far beyond the number explicitly configured on the user. Removing arbitrary groups can change access decisions. Reduce the source of expansion or redesign the authorization boundary with an understanding of effective permissions.
What to inspect
- Count unique SIDs after group expansion and note duplicates separately.
- Record SIDHistory and trusted-domain contributions when the token crosses a trust.
- Use supported directory and authorization tools to simplify group membership; do not truncate a token buffer.
References
- Microsoft: Security identifiers in Active Directory
- Microsoft: Security Identifiers API
- Samba: Active Directory trusts
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.