What does Windows error code 680 (ERROR_GUID_SUBSTITUTION_MADE) mean?

ERROR_GUID_SUBSTITUTION_MADE

What ERROR_GUID_SUBSTITUTION_MADE means

Translation completed with a fallback mapping. Security is not weakened by the substitution, but the resulting SID can be more restrictive than the administrator expected and may not match identities generated under another mapping policy.

Where it appears

• identity translation in distributed or directory-backed security
• migration of objects carrying GUID-based principals
• ACL construction where a GUID must become a Windows SID

Likely causes

• missing administrative GUID prefix mapping
• configuration not replicated to the translating system
• an identity originating outside the local mapping domain

What to collect

1. source GUID and resulting SID
2. mapping configuration on all participating systems
3. effective ACL before and after translation
4. access failures involving the substituted principal

How to respond

Define and deploy the intended mapping when consistent identity is required, then regenerate or repair affected ACLs. Verify effective access rather than assuming that successful translation preserved the intended authorization.

References

• Microsoft: System error codes 500–999