| Previous | Next |
| ERROR_SERVER_NOT_DISABLED | ERROR_ALLOTTED_SPACE_EXCEEDED |
ERROR_INVALID_ID_AUTHORITY
The top-level authority portion of a security identifier is not acceptable
The SID_IDENTIFIER_AUTHORITY field is a six-byte value identifying the top-level authority that issued or defines the SID namespace. Well-known Windows SIDs combine defined authority values with subauthority/RID components. This error is about that authority field itself, and should be distinguished from ERROR_INVALID_SUB_AUTHORITY, which points to later SID components.
Inspect the binary SID rather than only its account display name. If code constructs SIDs manually, use AllocateAndInitializeSid or the well-known SID APIs with documented authority constants and verify the buffer layout. Endianness assumptions or copying a textual S-1-... representation into a SID structure can corrupt the authority bytes. If the SID came from a protocol or persistent store, retain the original bytes and validate them before account lookup; a name-resolution retry cannot repair an invalid SID structure.
What to inspect
- Capture the raw SID and validate its revision, authority, and subauthority count.
- Use documented identifier-authority constants when constructing well-known SIDs.
- Separate structural SID validation from later account-name lookup.
References
Looking for a different code? Search another status or error code.