| Previous | Next |
| ERROR_TOO_MANY_SECRETS | ERROR_INTERNAL_DB_ERROR |
ERROR_SECRET_TOO_LONG
The private value is too large for an LSA secret operation
LSA provides secret objects and private-data storage through its policy database. ERROR_SECRET_TOO_LONG concerns the secret value length, not the user password complexity rules and not the secret object’s name. MS-LSAD documents separate naming constraints for LsarCreateSecret, which is why name-length failures and value-size failures should be diagnosed independently.
Measure the byte length at the LSA API boundary after serialization and encryption framing performed by the client library. Do not split one logical credential into arbitrary fragments without a documented recovery scheme. If the data is application-owned and substantially larger than a credential-sized value, use an appropriate protected storage design and store only the necessary key or reference in the secret facility.
What to inspect
- Record the value length without logging the secret contents.
- Keep secret-name validation separate from secret-value size.
- Review whether the application is using LSA private data for a payload that belongs in another protected store.
References
Looking for a different code? Search another status or error code.