| Previous | Next |
| STATUS_NO_INHERITANCE | STATUS_PARTIAL_COPY |
STATUS_GUID_SUBSTITUTION_MADE
A GUID-to-SID translation completed with a substitute prefix
STATUS_GUID_SUBSTITUTION_MADE is a warning-level result from a security identifier translation path. The important detail is that Windows security ultimately evaluates SIDs, whose binary form contains a revision, an identifier authority, and subauthorities. The reported translation did not find an administratively defined GUID prefix and used a substitute prefix instead.
This should be treated as a provenance and access-shape warning rather than as proof of a corrupt ACL. The NTSTATUS definition explicitly says the substitution does not compromise system security, but it can produce access that is more restrictive than intended. That distinction matters when a protection operation technically completes yet a principal later receives less access than the administrator expected.
Capture the source GUID, resulting SID, target file-system operation, and the security descriptor before and after translation. Use SID-aware tools and APIs to compare identifier authority and subauthority components; do not compare textual names alone because name resolution can hide the binary identity that is actually stored. If the issue follows a migration or namespace change, verify the administrative mapping configuration used by the translating component instead of manually editing the substituted SID in-place.
What to inspect
- Log both the original GUID and the final binary/textual SID produced by translation.
- Compare effective access with the intended policy because the warning can indicate unexpectedly restrictive protection.
- Investigate the mapping authority or migration configuration that performs translation; do not invent a GUID prefix from the status name.
References
- Microsoft: Security identifiers
- Microsoft: SID_IDENTIFIER_AUTHORITY
- Microsoft: GetSidIdentifierAuthority
- Microsoft: File security and access rights
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.