| Previous | Next |
| CONTEXT_E_OLDREF | CONTEXT_E_TMNOTAVAILABLE |
CONTEXT_E_ROLENOTFOUND
CONTEXT_E_ROLENOTFOUND is the failure HRESULT 0x8004E00C (signed decimal -2147164148, unsigned decimal 2147803148). Its severity bit is 1, facility is 4 (FACILITY_ITF), and the facility-specific code field is 0xE00C.
The authorization query references no role in the current COM+ application
This HRESULT means the specified role was not configured for the COM+ application. It is a configuration-name failure, not a negative membership decision for an existing role.
AllStat describes the result as “The specified role was not configured for the application.” for it, this wording identifies the immediate COM+ condition, while surrounding context and earlier events determine why it was reached.
Contract boundary
Role names are resolved within the current COM+ application and security configuration. A similarly named Windows group or role in another application does not satisfy the lookup.
Causes that fit this specific result
- Deployment omitted creation of the role used by
IsCallerInRole. - The application requests a misspelled, renamed, or environment-specific role name.
- A component was moved to another COM+ application whose role catalog differs.
- Catalog restoration or package import preserved components but not the expected security assignments.
Evidence to preserve before changing the system
- Record the exact role string, application ID, component CLSID, and direct caller identity.
- Export or enumerate the COM+ application roles and compare names with deployment manifests.
- Capture whether role-based security is enabled for the current context.
- Verify the component is activated in the intended application rather than a duplicate package.
Diagnostic sequence
- Create or restore the role through Component Services or the COMAdmin interfaces.
- Correct the application configuration or the literal role name without silently granting a broader role.
- Assign users or groups only after the role object itself exists.
- Retest both a member and nonmember to distinguish lookup correctness from authorization policy.
Retry and recovery
Repair the catalog and reactivate the application so new contexts see the role. Repeating the check before configuration changes will return the same result.
What the result does not establish
The HRESULT does not mean the caller lacks permission. Once the role exists, the membership check can still return false without an error.
Difference from nearby HRESULT values
E_ACCESSDENIED is an authorization denial. A false result from IsCallerInRole means a valid role was found but the direct caller is not a member.
Practical scenario
A deployment renames “OrderApprovers” to “Approvers” in one environment but the component still checks the old string. COM+ returns this code; the deployment manifest is corrected and role membership is then tested separately.
Developer and telemetry guidance
Treat role names as deployable configuration with validation. Startup health checks can compare every role referenced by code against the actual COM+ catalog before traffic is accepted.
Official Microsoft references
- Microsoft: COM transaction and context error codes
- Microsoft: checking COM+ role membership
- Microsoft: ISecurityCallContext
- Microsoft: the COM+ catalog
- Microsoft: HRESULT values in MS-ERREF
Looking for a different code? Search another status or error code.