| Previous | Next |
| STATUS_LUIDS_EXHAUSTED | STATUS_INVALID_ACL |
STATUS_INVALID_SUB_AUTHORITY
The SID hierarchy is not valid for this operation
A Windows SID contains an identifier authority followed by a bounded sequence of 32-bit subauthorities. Many APIs also assign meaning to particular positions, such as a domain identifier followed by a relative identifier. This status reports that the supplied hierarchy cannot be used as requested.
Do not repair a SID by deleting or shifting components. That can turn one identity into another. Validate the complete binary SID, its subauthority count, and the operation that consumes it. A syntactically valid SID can still be semantically wrong for an API that requires a domain SID, account SID, or well-known SID.
What to inspect
- Run IsValidSid and record the subauthority count before dereferencing any component.
- Compare the SID with the account authority that issued it, not only with a textual prefix.
- Re-resolve the principal name through the correct domain or local authority instead of editing the SID string.
References
- Microsoft: Security identifiers in Active Directory
- Microsoft: SID components
- Microsoft: Security Identifiers API
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.