| Previous | Next |
| STATUS_PASSWORD_MUST_CHANGE | STATUS_NOT_TINY_STREAM |
STATUS_NOT_FOUND
Preserve the lookup key and namespace; the status does not identify the object type
STATUS_NOT_FOUND is intentionally generic. It reports a lookup miss, but the object being searched depends entirely on the routine that returned it. For example, WmiQueryTraceInformation documents the status when a requested global logger is not found. Other kernel components can use the same value for their own object, key, or index lookups.
The diagnostic mistake is to turn this status into a file-path problem without evidence. Log the API, namespace, selector type, and complete lookup key before conversion to another error domain. If the key is a GUID, record the GUID; if it is a trace name, preserve the normalized name; if an enumeration produced a handle or identifier, record the generation/lifetime context in which it was obtained.
Also separate “never existed” from “existed but was removed between discovery and use.” Many Windows objects have independent lifetimes, and a successful enumeration is not necessarily a permanent reservation. If the API documents a re-enumeration or recreate path, use it. Do not loop indefinitely on a stale identifier: repeated STATUS_NOT_FOUND with the same key is evidence that the lookup input or object lifetime needs investigation.
What to inspect
- Record the exact namespace and lookup key together with the routine returning the status.
- Check whether the identifier came from an earlier enumeration and can become stale.
- Use the documented recreate/re-enumerate path rather than converting every miss into a file search.
References
- Microsoft: WmiQueryTraceInformation
- Microsoft: Object management
- Microsoft: Using NTSTATUS values
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.