| Previous | Next |
| STATUS_LOGON_NOT_GRANTED | STATUS_SECRET_TOO_LONG |
STATUS_TOO_MANY_SECRETS
The LSA secret store reached its object-count limit
LSA private data is stored as named secret objects and is intended for specific system or server-application credentials, not as a general encrypted database. This status means the implementation limit on secret objects has been exhausted. Creating random new key names for every update can therefore turn a cleanup bug into a system-wide policy-store failure.
Enumerate the application or service behavior that creates secrets and identify stale names before deleting anything. Secret names can represent operating-system or service credentials, so bulk removal from the policy database is unsafe. Correct the producer and remove only objects whose ownership and lifecycle are understood.
What to inspect
- Record the key-name pattern and component issuing LsaStorePrivateData or LSAD secret calls.
- Identify unbounded creation of new secret names instead of updates to existing objects.
- Delete only confirmed stale application-owned secrets through supported LSA operations.
References
- Microsoft: LsaStorePrivateData
- Microsoft: LsaRetrievePrivateData
- Microsoft Open Specifications: MS-LSAD product behavior
Looking for a different code? Search another status or error code.