| Previous | Next |
| ERROR_HOST_DOWN | ERROR_NON_DOMAIN_SID |
ERROR_NON_ACCOUNT_SID
The SID is not from an account domain.
ERROR_NON_ACCOUNT_SID is Win32 error 1257 (0x4E9). The supplied security identifier may be syntactically valid, yet it is not an account SID belonging to a local or domain account namespace. Windows also uses SIDs for authorities, capabilities, integrity levels, services, packages, and other security concepts that are not user or group accounts.
Why SID validity is not enough
IsValidSid checks structure, not semantic type. An API that needs an account-domain SID expects a domain portion plus a relative identifier representing a principal. Passing a well-known SID or a security label can therefore fail with 1257 even though the bytes form a valid SID.
Evidence to collect
- the SID string, source field, and operation that requires an account
- the result and SID_NAME_USE from
LookupAccountSid - whether the SID came from a token user, group, owner, label, capability, or service field
- the target domain or local security authority used for lookup
- any serialization or truncation performed before validation
Diagnostic sequence
Validate the SID structure, resolve it through LookupAccountSid, and inspect the returned use type. If the operation needs the account domain, call GetWindowsAccountDomainSid and handle failure explicitly. Confirm that code did not accidentally read a mandatory label or package SID from a token when it intended to read TokenUser.
When the SID arrives over a protocol, compare the original string with the parsed binary value and enforce size limits. Do not guess an account name from the final RID; the same RID can exist in different domains.
Recovery
Obtain the SID from an account-aware source or ask the caller to select a user or group instead of accepting arbitrary SID text. If non-account principals are legitimately supported, route them through a separate code path with appropriate semantics rather than forcing them into account-domain APIs.
Difference from related SID errors
ERROR_INVALID_SID means the SID structure itself is invalid. ERROR_NONE_MAPPED means no account name could be resolved. ERROR_NON_DOMAIN_SID says the SID has no extractable domain component. Error 1257 specifically rejects the SID’s principal category.
Example
An access-control tool reads the integrity-label ACE from a security descriptor and passes that SID to code that expects a user account. The SID is valid, but lookup classifies it as a label and the account-domain operation returns 1257. Reading the owner or token-user SID fixes the source selection.
References
- Microsoft: System Error Codes (1000–1299)
- Microsoft: LookupAccountSidW function
- Microsoft: GetWindowsAccountDomainSid function
- Microsoft: Understand Security Identifiers
Looking for a different code? Search another status or error code.