| Previous | Next |
| DB_E_OBJECTCREATIONLIMITREACHED | SEC_E_NOTRUSTEEID |
SEC_E_BADTRUSTEEID
Meaning
Windows documents SEC_E_BADTRUSTEEID as “Trustee is invalid”. In this case, a security-administration call receives a trustee representation that is structurally invalid.
Relevant contract
OLE DB security administration represents trustees, owners, groups, protected objects and access-entry lists as separate entities. A syntactically valid trustee can still be unknown to a provider, and an allowed permission set depends on the protected object type.
Investigation of this result should start with the provider security interface, effective data-source namespace and exact trustee or access-entry structure supplied.
Conditions that specifically lead to the result
- Cause 1: the trustee form or identifier type is unsupported.
- Cause 2: required name or SID data is missing.
- Cause 3: structure length, pointer or encoding is corrupt.
Evidence to collect
- Evidence 1: trustee form and identifier type.
- Evidence 2: validated length and redacted identifier.
- Evidence 3: the exact security method and target object.
Diagnostic sequence
- Identify the exact failing stage: a security-administration call receives a trustee representation that is structurally invalid.
Corrective actions
- Action 1: build trustees with the documented structure contract.
- Action 2: validate names or SIDs before the provider call.
- Action 3: avoid casting unrelated security structures into the trustee field.
Retry and recovery
Retry rule: retry after constructing a syntactically valid trustee identifier.
Practical scenario
An ACL importer passes an empty name trustee after parsing a malformed record; rejecting it earlier prevents it.
Difference from nearby HRESULT values
SEC_E_NOTRUSTEEID means a valid trustee is unknown to the data source, while SEC_E_BADTRUSTEEID means the representation itself is invalid.
Official Microsoft references
Looking for a different code? Search another status or error code.