| Previous | Next |
| STATUS_APPHELP_BLOCK | STATUS_NOT_SAFE_MODE_DRIVER |
STATUS_ALL_SIDS_FILTERED
No trusted authorization SID survived filtering
When authentication crosses a domain or forest trust, the receiving side validates SIDs carried in authorization data. SID filtering is intended to prevent a trusted domain from asserting identities that belong to another protected namespace. This status means the complete set was rejected.
Disabling filtering is not a safe first response. Determine which SIDs were presented, their issuing domains, and the trust type and direction. Migration scenarios involving SIDHistory require correctly configured trusts and allowed namespace relationships, not blanket acceptance of foreign SIDs.
What to inspect
- Capture the incoming PAC or token SID list and the trust through which it arrived.
- Classify each rejected SID by domain, RID, and whether it came from SIDHistory.
- Review trust configuration on both Windows and interoperating Samba controllers before changing filtering policy.
References
- Samba: Active Directory trusts
- Samba: Active Directory security implementation notes
- Microsoft: Security identifiers in Active Directory
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.