| Previous | Next |
| STATUS_MCA_EXCEPTION | STATUS_SYMLINK_CLASS_DISABLED |
STATUS_CERTIFICATE_MAPPING_NOT_UNIQUE
Certificate authentication cannot select one principal
Certificate-based logon can use explicit mappings such as altSecurityIdentities and other strong-binding information. Authentication must resolve the presented certificate to exactly one account. If multiple directory objects satisfy the mapping, accepting either one would make identity selection ambiguous.
Compare all mapping forms, not just subject names. Issuer and serial values, public-key hashes, SID extensions, and explicit attributes can overlap. Remove or correct duplicate mappings only after confirming which account owns the credential and whether the certificate must be reissued.
What to inspect
- Record the complete certificate chain, issuer, serial number, public-key identifier, and SID extension when present.
- Search the directory for every matching altSecurityIdentities value and strong mapping.
- Use KDC and certificate-authentication events to confirm the mapping path before editing accounts.
References
- Microsoft: altSecurityIdentities and certificate mappings
- Microsoft: cross-forest certificate authentication
- Microsoft: Security identifiers in Active Directory
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.