| Previous | Next |
| hrUnknownExpiryTokenFormat | hrFileClose |
hrContentsExpired
Operational meaning
For hrContentsExpired, the hexadecimal HRESULT is most useful when kept beside the API call and the affected artifact. The decisive boundary is the Directory Service judged the backup contents too old under the expiry information associated with the set.
The stored Value is 0xC7FF0011 (facility-specific HRESULT). The HRESULT carries failure severity, so output state must be treated according to the individual API contract. The legacy this result name comes from the Windows Directory Service backup/restore message header.
The first useful distinction is that the failure is a freshness policy result, not proof that the database or logs are physically corrupt. Start by record backup creation time, token metadata, current time source, domain-controller role, and available newer system-state backups. That separates a reproducible incident from a later generic cleanup or service error.
Before altering files or retrying
Preserve the first result before retries, cleanup, service restart, or file replacement changes the evidence. The diagnostic record should identify the exact API phase and the owner of every handle or artifact involved.
- Code-specific observation: record backup creation time, token metadata, current time source, domain-controller role, and available newer system-state backups.
- Restore preparation parameters: record it together with this result and the timestamp of the first occurrence.
- Token byte length and hash: record it together with this result and the timestamp of the first occurrence.
- Backup-set identifier: record it together with this result and the timestamp of the first occurrence.
- Storage/copy transformations: record it together with it and the timestamp of the first occurrence.
Use hashes, lengths, IDs, generation numbers, and redacted samples instead of copying directory contents or sensitive database values into routine logs. For this it investigation, a complete provenance chain is often more useful than a second automatic retry.
Comparison points
It specifically means that the failure is a freshness policy result, not proof that the database or logs are physically corrupt. Related values below can appear in the same workflow but require a different response:
hrMissingExpiryToken | the restore request lacks the expiry token created with the backup set |
|---|---|
hrUnknownExpiryTokenFormat | bytes were supplied as an expiry token but the Directory Service cannot parse their format |
hrDeleteBackupFileFail | backup cleanup could not delete an artifact it was responsible for removing |
Keep the original constant and hexadecimal value in telemetry. Replacing it with “backup failed” or “database warning” removes the state information needed to select the next legal API call.
Objects and state involved
| Diagnostic layer | the opaque expiry token linking a legacy AD backup set to restore authorization and freshness |
|---|---|
| Relevant API surface | DsBackupPrepare token output and DsRestorePrepare token input |
| Code-specific boundary | the Directory Service judged the backup contents too old under the expiry information associated with the set |
| Narrow corrective direction | select a newer valid system-state backup and follow supported AD recovery guidance instead of bypassing expiry checks |
The token must be stored as opaque binary data with the backup set., without a token, DsRestorePrepare returns a restricted context usable only to query restore locations.
Recommended handling
- Record it,
0xC7FF0011, the API name, the current phase, and all live context or file owners. - Verify the decisive condition by record backup creation time, token metadata, current time source, domain-controller role, and available newer system-state backups.
- Apply only the narrow correction: select a newer valid system-state backup and follow supported AD recovery guidance instead of bypassing expiry checks.
- After it, recreate any context invalidated by the failure; do not carry stale HBC, cursor, file, or restore-map state into the retry.
- repeat the smallest non-destructive test that reaches the same boundary, then verify both the return value and the resulting file, cursor, backup, or database state.
Acceptance criteria for a fix
A useful regression test for this HRESULT should force the condition “the Directory Service judged the backup contents too old under the expiry information associated with the set”, call one documented API transition, and assert the exact HRESULT. The corrected the case should change only the decisive precondition and should verify cleanup as well as the primary output. For the result backup or restore path, also prove that the resulting set can be enumerated and that no file handle or context remains active after finalization.
Actions that can make diagnosis worse
- do not borrow a token from another backup set.
- do not convert the token through text encoding.
- do not discard the first lower-level Win32, RPC, or JET result merely because a later cleanup call returned a more familiar error.
Technical references
- DsRestorePrepare token rules — API ordering, file semantics, warning/error interpretation, or recovery behavior relevant to it.
- AD backup walkthrough
- AD restore walkthrough
- Microsoft list of AD DS backup errors
Looking for a different code? Search another status or error code.