| Previous | Next |
| ERROR_NOT_ALL_ASSIGNED | ERROR_NO_QUOTAS_FOR_ACCOUNT |
ERROR_SOME_NOT_MAPPED
A batch account-name lookup translated some principals but not all of them
Windows authorization ultimately uses security identifiers rather than display names. LsaLookupNames2 accepts an array of account names and returns one translated SID entry for each input position. STATUS_SOME_NOT_MAPPED is an informational result for partial success: at least one name was resolved, while one or more entries could not be translated. That is materially different from a complete lookup failure or from STATUS_NONE_MAPPED, where no names resolve at all.
Inspect the returned translated array entry by entry instead of discarding the whole batch. Isolated names can collide across local, primary, and trusted domains, so fully qualified DOMAIN\name or UPN forms are better diagnostic inputs. Also record the referenced-domain list and current trust/domain reachability. Renaming or deleting an account can leave an ACL or policy containing a valid SID whose friendly name no longer resolves; that reverse-lookup situation should not be confused with failure to translate an input name.
What to inspect
- Record exactly which input names were mapped and which entries were not.
- Retry ambiguous isolated names in qualified DOMAIN\name or UPN form.
- Check domain and trust reachability before rewriting ACLs or replacing SIDs.
References
Looking for a different code? Search another status or error code.