| Previous | Next |
| STATUS_TOO_MANY_SECRETS | STATUS_INTERNAL_DB_ERROR |
STATUS_SECRET_TOO_LONG
The LSA secret is longer than the store accepts
LSA private-data APIs accept an LSA_UNICODE_STRING key and private-data value, but the policy database imposes implementation limits. This status means the caller crossed the allowed secret length. Splitting arbitrary application data into more LSA secrets is usually the wrong fix because the facility is not designed as a generic encrypted blob store.
Measure the key and value sizes at the API boundary and confirm the caller is passing the intended character count rather than a byte-count or unterminated buffer error. For generic application secrets, use a supported data-protection design instead of expanding dependence on LSA private data.
What to inspect
- Record key-name length and private-data length in bytes and characters.
- Check construction of LSA_UNICODE_STRING Length and MaximumLength.
- Use LSA secrets only for the documented private-data scenario; redesign oversized generic storage.
References
- Microsoft: LsaStorePrivateData
- Microsoft: LsaRetrievePrivateData
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.