| Previous | Next |
| STATUS_INVALID_LOGON_TYPE | STATUS_CANNOT_IMPERSONATE |
STATUS_NO_GUID_TRANSLATION
The failure occurs while storing protection metadata, not while checking a caller’s current access
STATUS_NO_GUID_TRANSLATION is tied to assigning a security descriptor to a file-system object. Windows security descriptors carry owners, groups, DACLs and SACLs using security identifiers (SIDs). The status indicates that one SID in the descriptor could not be translated into the GUID representation required by the file system that is storing the protection information.
Start with the exact descriptor being applied and the target file system or remote server. Enumerate every SID in the owner, primary group, DACL and SACL, retaining unresolved SIDs as numeric values instead of replacing them by guessed account names. When the target is remote or non-Windows storage, compare its security-descriptor and identity-mapping capabilities with the local source.
Changing ordinary file permissions interactively can hide the failing SID by producing a different descriptor, but that does not explain why backup restore, migration, or file creation failed. Preserve the original descriptor and identify the specific identity that cannot be represented. The relevant repair may be an identity-mapping or file-system compatibility change, not granting the caller more access.
What to inspect
- The complete self-relative security descriptor that failed, including owner, group, DACL, SACL, ACE types and every SID value.
- The target file system, SMB/NAS implementation, mount or share, and whether the same descriptor succeeds on NTFS or another target.
- Unresolved or migrated SIDs, SIDHistory values, and any identity mapping layer used by the destination.
References
- Microsoft: Security descriptors
- Microsoft: Security identifiers
- Samba: smbcacls security descriptor tool
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.