Windows / Error types

Windows Error Formats

Windows contains a vast number of error codes in various formats. This document explains the Win32, HRESULT, NTSTATUS, and LSTATUS error codes.

Win32

Win32 API error codes are possibly the most known code structure in Windows. These codes are used for various modules including the user-mode kernel modules (ntdll.dll).

All Windows error code should fit under 16-bit numbers between 0x0 (0) to 0xffff (65,535). However, some error codes may use a 32-bit number space with extended fields (ie, HRESULT).

HRESULT

HRESULT codes are used under the COM system

The table below denotes the structure of a HRESULT code.

31	30	29	28	27	2616
S	R	C	N	X	Facility
150
Code

Legend

S (1 bit): Severity. If set, indicates a failure result. If clear, indicates a success result.
R (1 bit): Reserved. This bit must be cleared.
C (1 bit): Customer. Set for customer-defined values. All Microsoft values have this bit cleared.
N (1 bit): NTSTATUS if set.
X (1 bit): Reserved. Should be cleared, at the exception of a few codes described further below.
Facility (11 bits): Error source. A list of facilities are listed further below.
Code (16 bits): Error code.

HRESULT Facilities

The table below lists facilities defined in the MS-ERREF specification.

Name	Value	Description
0	FACILITY_NULL	Default
1	FACILITY_RPC	RPC subsystem
2	FACILITY_DISPATCH	COM Dispatch
3	FACILITY_STORAGE	OLE Storage
4	FACILITY_ITF	COM/OLE Interface management
7	FACILITY_WIN32	Win32
8	FACILITY_WINDOWS	Windows
9	FACILITY_SECURITY	Security API
10	FACILITY_CONTROL	Control mechanism
11	FACILITY_CERT	Certificate
12	FACILITY_INTERNET	Wininet
13	FACILITY_MEDIASERVER	Windows Media Server
14	FACILITY_MSMQ	Microsoft Message Queue
15	FACILITY_SETUPAPI	Setup API
16	FACILITY_SCARD	Smart-card subsystem
17	FACILITY_COMPLUS	COM+
18	FACILITY_AAF	Microsoft agent
19	FACILITY_URT	.NET CLR
20	FACILITY_ACS	Audit Collection Service
21	FACILITY_DPLAY	Direct Play
22	FACILITY_UMI	Ubiquitous Memory-introspection service
23	FACILITY_SXS	Side-by-side (sxs) servicing
24	FACILITY_WINDOWS_CE	Windows CE
25	FACILITY_HTTP	HTTP
26	FACILITY_USERMODE_COMMONLOG	Common Logging
31	FACILITY_USERMODE_FILTER_MANAGER	User Mode Filter Manager
32	FACILITY_BACKGROUNDCOPY	Background Copy
33	FACILITY_CONFIGURATION	Configuration Services
34	FACILITY_STATE_MANAGEMENT	State Management Services
35	FACILITY_METADIRECTORY	Microsoft Identity Server
36	FACILITY_WINDOWSUPDATE	Windows update
37	FACILITY_DIRECTORYSERVICE	Active Directory
38	FACILITY_GRAPHICS	Graphics drivers
39	FACILITY_SHELL	User shell
40	FACILITY_TPM_SERVICES	Trusted Platform Module services
41	FACILITY_TPM_SOFTWARE	Trusted Platform Module applications
48	FACILITY_PLA	Performance Logs and Alerts
49	FACILITY_FVE	Full Volume Encryption
50	FACILITY_FWP	Firewall Platform
51	FACILITY_WINRM	Windows Resource Manager
52	FACILITY_NDIS	Network Driver Interface
53	FACILITY_USERMODE_HYPERVISOR	Usermode Hypervisor components
54	FACILITY_CMI	Configuration Management Infrastructure
55	FACILITY_USERMODE_VIRTUALIZATION	User Mode Virtualization Subsystem
56	FACILITY_USERMODE_VOLMGR	User Mode Volume Manager
57	FACILITY_BCD	Boot Configuration Database
58	FACILITY_USERMODE_VHD	User Mode Virtual Hard Disk
60	FACILITY_SDIAG	System Diagnostics
61	FACILITY_WEBSERVICES	Web Services
80	FACILITY_WINDOWS_DEFENDER	Windows Defender
81	FACILITY_OPC	Open Connectivity service

Some HRESULT codes, as exceptions, have the X bit set. They are listed below.

Name	Value
0x0DEAD100	TRK_S_OUT_OF_SYNC
0x0DEAD102	TRK_VOLUME_NOT_FOUND
0x0DEAD103	TRK_VOLUME_NOT_OWNED
0x0DEAD107	TRK_S_NOTIFICATION_QUOTA_EXCEEDED
0x8DEAD01B	TRK_E_NOT_FOUND
0x8DEAD01C	TRK_E_VOLUME_QUOTA_EXCEEDED
0x8DEAD01E	TRK_SERVER_TOO_BUSY

Converting Win32 error codes to an HRESULT code is done with thefollowing C macro.

#define FACILITY_WIN32 0x0007
#define __HRESULT_FROM_WIN32(x) ((HRESULT)(x) <= 0 ? ((HRESULT)(x)) : ((HRESULT) (((x) & 0x0000FFFF) | (FACILITY_WIN32 << 16) | 0x80000000)))

NTSTATUS

NTSTATUS error codes are typically used for low-level operations such as machine check exceptions, debugger API, and the SysWOW64 32-bit application layer, communicated from the WindowsNT kernel.

These codes are defined in Ntdef.h and have the following structure.

31 30	29	28	27 16
Sev	C	N	Facility
15 0
Code

Legend

Sev (2 bits): Severity. Severity values are listed further below.
C (1 bit): Customer. Microsoft codes have this bit cleared.
N (1 bit): Reserved. Must be cleared so it can correspond to a HRESULT.
Facility (12 bits): Source facility.
Code (16 bits): Error code.

NTSTATUS Severities

Value	Name	Description
0x0	STATUS_SEVERITY_SUCCESS	Success.
0x0	STATUS_SEVERITY_SUCCESS	Success.
0x1	STATUS_SEVERITY_INFORMATIONAL	Informational.
0x2	STATUS_SEVERITY_WARNING	Warning.
0x3	STATUS_SEVERITY_ERROR	Error.

NTSTATUS Facilities

The table below lists facilities defined in the MS-ERREF specification.

Name	Value	Description
1	FACILITY_DEBUGGER	Windows Debugger
2	FACILITY_RPC_RUNTIME	Windows Remote Procedure Call Runtime
3	FACILITY_RPC_STUBS	Windows Remote Procedure Call Stub
4	FACILITY_IO_ERROR_CODE	Input/Output
7	FACILITY_NTWIN32	WindowsNT Win32
9	FACILITY_NTSSPI	Security Support Provider Interface (SSPI)
10	FACILITY_TERMINAL_SERVER	Windows Terminal Server
11	FACILTIY_MUI_ERROR_CODE	Multilingual User Interface
16	FACILITY_USB_ERROR_CODE	Universal Serial Bus
17	FACILITY_HID_ERROR_CODE	Humand Interface Device
18	FACILITY_FIREWIRE_ERROR_CODE	IEEE 1394 FireWire
19	FACILITY_CLUSTER_ERROR_CODE
20	FACILITY_ACPI_ERROR_CODE	Advanced Configuration and Power Interface
21	FACILITY_SXS_ERROR_CODE	Windows Side-by-Side
25	FACILITY_TRANSACTION	Windows Kernel Transaction Manager (KTM)
26	FACILITY_COMMONLOG	Windows Common Log File System (CLFS)
27	FACILITY_VIDEO	Windows Media Foundation
28	FACILITY_FILTER_MANAGER	Windows Filter Manager (FltMgr.sys)
29	FACILITY_MONITOR	Windows Monitor File
30	FACILITY_GRAPHICS_KERNEL	Windows DirectX Graphics Kernel
32	FACILITY_DRIVER_FRAMEWORK	Windows Driver Framework (WDF)
33	FACILITY_FVE_ERROR_CODE	Windows Full Volume Encryption
34	FACILITY_FWP_ERROR_CODE	Windows Filtering Platform (WFP)
35	FACILITY_NDIS_ERROR_CODE	Windows Network Driver Interface Specification
53	FACILITY_HYPERVISOR	Windows Hyper-V
54	FACILITY_IPSEC	Windows IPSec

LSTATUS

The LSTATUS codes are legacy error codes used in some Windows functions. The 'L' in LSTATUS connotates the Windows LONG data type, defined in winreg.h as LONG under WinNT.h. The LONG data type is defined as the C long data type.

Functions returning LSTATUS codes, such as the low-level Windows Registry API (winreg.h), intially introduced in Window 3.1 (1992), and the Windows Shell API (Shlwapi.h), do not seem to set the thread's last error code (for example, using SetLastError), resulting in confusing GetLastError results.

These error codes can also be used directly for FormatMessage with FORMAT_MESSAGE_FROM_SYSTEM.