| Previous | Next |
| STATUS_GUIDS_EXHAUSTED | STATUS_AGENTS_EXHAUSTED |
STATUS_INVALID_ID_AUTHORITY
The SID was issued under an unexpected authority
The six-byte identifier-authority field identifies the top-level authority responsible for the SID namespace. Windows account SIDs, built-in groups, world identities, and other principal classes use different authorities. This status means the value does not satisfy the contract of the operation receiving it.
A textual SID can look well formed while still naming an authority that the target component does not accept. Check how the SID was decoded and whether byte order was handled correctly. Never substitute NT AUTHORITY merely to make validation pass, because the authority is part of the principal identity.
What to inspect
- Preserve the original binary SID and its SDDL representation for comparison.
- Verify the identifier-authority bytes and the expected principal class.
- Resolve the principal again with LookupAccountName or the authoritative directory rather than synthesizing a replacement SID.
References
- Microsoft: SID components
- Microsoft: Security identifiers in Active Directory
- Microsoft: Security Identifiers API
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.