| Previous | Next |
| TRUST_E_ACTION_UNKNOWN | TRUST_E_SUBJECT_NOT_TRUSTED |
TRUST_E_SUBJECT_FORM_UNKNOWN
TRUST_E_SUBJECT_FORM_UNKNOWN identifies a failure in trust subject representation. The chosen trust provider recognizes the action but not the WINTRUST_DATA union choice or subject form supplied for the object. Diagnose trust subject representation at the first component that returned the value, not the last user-interface layer that displayed it; later cleanup and fallback attempts can produce different secondary errors.
Where the status is selected
WinVerifyTrust dispatches by an action GUID to a trust provider and then interprets the subject through the WINTRUST_DATA union choice. Provider installation, action support, and subject form are separate contracts; capture both the GUID and the union member selected by dwUnionChoice.
Evidence that changes the diagnosis
- Action GUID and installed provider capable of handling it
Record dwUnionChoice and the corresponding WINTRUST_FILE_INFO, CATALOG_INFO, BLOB_INFO, CERT_INFO, or SIGNER_INFO structure.
Identifies the trust action, subject representation, and signer state. - WINTRUST_DATA structure size, union choice, subject fields, and state-action flags
Initialize cbStruct fields and ensure the selected union pointer matches the choice.
Separates signature decoding, certificate selection, and final policy. - A known-good subject verified with the same action and a known action for the same subject
Check whether the action supports files, catalogs, blobs, certificates, or signer structures.
Prevents success under a different trust action from masking the original failure.
Correlate the failure with state changes
Trust verification is a pipeline, not one Boolean check in a trust subject representation investigation. Align artifact acquisition, signature decoding, signer selection, countersignature or timestamp processing, chain construction, revocation retrieval, and final action policy. Preserve provider state before closing it so the generic top-level result can be connected to the stage that actually rejected the subject.
- Original signed artifact or catalog identity and the exact WinVerifyTrust action and flags.
- In the path, signer, countersigner, timestamp, chain, revocation, and nested provider results.
- verification from a second tool configured to apply equivalent policy, not merely a signature-only check.
A controlled way to reproduce it
First call the documented standard action with its documented subject form., then change only the action GUID or union choice to match the production integration. This PINpoints dispatch versus subject representation in a trust subject representation investigation.
| Test | Interpretation |
|---|---|
| Same input, known-good path | For trust subject representation, success moves attention toward the selected provider, policy, device, context, or transaction state. |
| Known-good input, failing path | For trust subject representation, failure suggests that the environment or selected object is independently unable to perform the operation. |
| Original path after one isolated change | For trust subject representation, this comparison demonstrates whether the proposed correction addresses the original condition. |
Nearby results and misleading fixes
TRUST_E_ACTION_UNKNOWN means no suitable action provider; this code means the provider does not accept the selected subject representation. Trying random action GUIDs until one returns success changes the trust policy being asked, not merely the mechanism used to answer it in a trust subject representation investigation.
For trust subject representation, also retain the original numeric value; neighboring constants can encode materially different remediation paths even when an application presents all of them as an authentication, certificate, or security failure.
What counts as a real resolution
The intended action must be handled by the intended provider using a supported subject form, and state data must be closed according to the API contract. Keep a regression case that uses nonsecret identifiers and expected outcomes, including one negative control that must continue to fail.
Technical references
These sources define the HRESULT and the relevant trust subject representation interface, protocol, or data format.
- Microsoft Open Specifications: HRESULT values.
- Microsoft: WinVerifyTrustEx.
- Microsoft: WINTRUST_DATA.
- RFC 5652: Cryptographic Message Syntax.
Looking for a different code? Search another status or error code.