What does Windows error code 1258 (ERROR_NON_DOMAIN_SID) mean?

 
Previous Next
ERROR_NON_ACCOUNT_SID ERROR_APPHELP_BLOCK

ERROR_NON_DOMAIN_SID

The SID does not contain a usable domain portion.

ERROR_NON_DOMAIN_SID is Win32 error 1258 (0x4EA). An operation tried to derive or compare an account domain from a SID that has no applicable domain component. The SID can still be structurally correct and meaningful for another security purpose.

Account SID structure matters

A typical Windows account SID contains an authority, domain-identifying subauthorities, and a final relative identifier for the account. Well-known SIDs, integrity labels, capabilities, logon-session SIDs, and some service identities do not follow the account-domain pattern expected by domain extraction functions.

What to inspect

  • the full SID string and number of subauthorities
  • which token or security-descriptor field supplied the SID
  • whether the code expected a user, group, domain, service, or label
  • the result of account lookup and the returned SID type
  • the exact API that attempted to obtain a domain SID

Diagnostic sequence

Call IsValidSid first, then use LookupAccountSid to determine what the identifier represents. Attempt domain extraction only for supported account SID types. If the SID was built manually, verify the identifier authority and every subauthority rather than checking only its textual prefix.

Review token parsing carefully. TokenIntegrityLevel, TokenAppContainerSid, and TokenUser carry different kinds of principals. Selecting the wrong information class can produce a valid non-domain SID that survives several layers before failing with 1258.

Recovery and design

Use a domain-capable account SID when the operation genuinely requires domain comparison. If the product needs to support local capabilities or service principals, store their complete SID and compare according to that principal type instead of trying to normalize everything to a domain. Reject unsupported SID categories with a clear field-level message.

Difference from ERROR_NON_ACCOUNT_SID

Error 1257 says the identifier is not an account-domain principal. Error 1258 focuses on the missing domain component required by the current operation. The distinction is useful when a principal may be account-like but still cannot yield a domain SID through the selected API.

Example

A policy service compares a package capability SID with a user’s domain SID by calling GetWindowsAccountDomainSid on both values. The capability SID has no domain component and returns 1258. The correct design compares capabilities as capabilities and performs domain logic only on account SIDs.

References

Looking for a different code? Search another status or error code.