| Previous | Next |
| ERROR_LUIDS_EXHAUSTED | ERROR_INVALID_ACL |
ERROR_INVALID_SUB_AUTHORITY
Windows rejected the subauthority portion of a security identifier
A SID is a variable-length identifier composed of a revision, identifier authority, and one or more subauthority values. The subauthorities form the remaining components visible in the S-1-... string representation and can include domain-relative identifiers. This error means the requested operation cannot accept the supplied subauthority information; it is not a failure to translate a valid SID into an account name.
Validate the binary SID with the security APIs and inspect the revision, subauthority count, and individual RID values before using the structure. If the SID was manually assembled, calculate the required buffer size and initialize it with supported APIs rather than copying a textual form into a binary structure. Also confirm the operation expects the SID category being supplied. A syntactically valid SID can still be inappropriate for a specific API contract, so compare the failing call with a known-good SID of the same intended authority and use.
What to inspect
- Validate the SID structure and subauthority count before the failing call.
- Inspect each subauthority/RID and how the binary SID was constructed.
- Compare with a known-good SID of the same authority and intended API role.
References
Looking for a different code? Search another status or error code.