| Previous | Next |
| ERROR_VDM_DISALLOWED | ERROR_INVALID_CRUNTIME_PARAMETER |
ERROR_UNIDENTIFIED_ERROR
The available diagnostics do not identify the cause.
ERROR_UNIDENTIFIED_ERROR is Win32 error 1287 (0x507). It means that insufficient information remains to classify the failure. In practice, it is often a secondary result from a wrapper, broker, or recovery path that lost the original subsystem error before reporting to the caller.
How useful information gets lost
- a successful cleanup call overwrites the thread’s last-error value
- an exception is converted to a generic status without preserving details
- an asynchronous worker reports failure after its originating context is gone
- a remote service sends only “failed” and drops its native error payload
- several attempted strategies fail but only the final generic result is retained
Evidence to capture
Log the failing operation, subsystem boundary, correlation ID, native error code, HRESULT or NTSTATUS when present, exception type, remote response, and the first failure timestamp. Preserve errors immediately after the API call that sets them. A later log entry containing only 1287 cannot reconstruct the missing cause.
Diagnostic strategy
Add instrumentation at each translation boundary and distinguish “unknown because not classified” from “unknown because data was discarded.” Capture the first error and append context as it travels upward. For asynchronous code, copy error data into the completion object rather than reading thread-local state on another thread.
Reproduce with verbose component logging and compare successful and failing traces. If several fallback methods are tried, record every attempt with its own result and duration. Check whether cancellation, timeout, or process termination is being collapsed into 1287 even though those conditions should have dedicated statuses.
Developer guidance
Return 1287 only when the contract truly has no more specific code. Do not use it as a convenient replacement for validation, transport, authorization, or storage errors. Maintain a stable error envelope containing a machine-readable code, human context, source component, and optional nested cause.
Recovery
A blind retry is reasonable only when the operation is known to be idempotent and transient failure is plausible. Otherwise gather better telemetry first. Repeatedly returning 1287 should be treated as an observability defect because administrators cannot select a safe corrective action from an unidentified state.
Difference from generic operation failure
ERROR_GEN_FAILURE says a device or operation reported a general failure. Error 1287 emphasizes that the current reporting path lacks enough information to identify what happened. The remediation is therefore improved cause preservation as well as investigation of the underlying operation.
Example
A service calls a remote helper, receives a structured certificate error, logs out, and then returns only 1287 to its client. The logout call overwrites last-error state. Copying the helper’s error into the request result before cleanup exposes the real trust-chain problem.
References
- Microsoft: System Error Codes (1000–1299)
- Microsoft: Retrieving the last-error code
- Microsoft: FormatMessage
Looking for a different code? Search another status or error code.