NTSTATUS Code Reference

NTSTATUS codes appear in Status and SubStatus fields of Windows Security events (4625, 4776, and others). The high nibble indicates severity: 0x0 success, 0x4 informational, 0x8 warning, 0xC error.

Download as JSON (2,843 codes)

Success (0x00000000 – 0x3FFFFFFF)#

CodeName
0x00000000STATUS_SUCCESS
0x00000001STATUS_WAIT_1
0x00000002STATUS_WAIT_2
0x00000003STATUS_WAIT_3
0x0000003FSTATUS_WAIT_63
0x00000080STATUS_ABANDONED_WAIT_0
0x000000BFSTATUS_ABANDONED_WAIT_63
0x000000C0STATUS_USER_APC
0x000000FFSTATUS_ALREADY_COMPLETE
0x00000100STATUS_KERNEL_APC
0x00000101STATUS_ALERTED
0x00000102STATUS_TIMEOUT
0x00000103STATUS_PENDING
0x00000104STATUS_REPARSE
0x00000105STATUS_MORE_ENTRIES
0x00000106STATUS_NOT_ALL_ASSIGNED
0x00000107STATUS_SOME_NOT_MAPPED
0x00000108STATUS_OPLOCK_BREAK_IN_PROGRESS
0x00000109STATUS_VOLUME_MOUNTED
0x0000010ASTATUS_RXACT_COMMITTED
0x0000010BSTATUS_NOTIFY_CLEANUP
0x0000010CSTATUS_NOTIFY_ENUM_DIR
0x0000010DSTATUS_NO_QUOTAS_FOR_ACCOUNT
0x0000010ESTATUS_PRIMARY_TRANSPORT_CONNECT_FAILED
0x00000110STATUS_PAGE_FAULT_TRANSITION
0x00000111STATUS_PAGE_FAULT_DEMAND_ZERO
0x00000112STATUS_PAGE_FAULT_COPY_ON_WRITE
0x00000113STATUS_PAGE_FAULT_GUARD_PAGE
0x00000114STATUS_PAGE_FAULT_PAGING_FILE
0x00000115STATUS_CACHE_PAGE_LOCKED
0x00000116STATUS_CRASH_DUMP
0x00000117STATUS_BUFFER_ALL_ZEROS
0x00000118STATUS_REPARSE_OBJECT
0x00000119STATUS_RESOURCE_REQUIREMENTS_CHANGED
0x00000120STATUS_TRANSLATION_COMPLETE
0x00000121STATUS_DS_MEMBERSHIP_EVALUATED_LOCALLY
0x00000122STATUS_NOTHING_TO_TERMINATE
0x00000123STATUS_PROCESS_NOT_IN_JOB
0x00000124STATUS_PROCESS_IN_JOB
0x00000125STATUS_VOLSNAP_HIBERNATE_READY

Informational (0x40000000 – 0x7FFFFFFF)#

CodeName
0x40000000STATUS_OBJECT_NAME_EXISTS
0x40000001STATUS_THREAD_WAS_SUSPENDED
0x40000002STATUS_WORKING_SET_LIMIT_RANGE
0x40000003STATUS_IMAGE_NOT_AT_BASE
0x40000004STATUS_RXACT_STATE_CREATED
0x40000005STATUS_SEGMENT_NOTIFICATION
0x40000006STATUS_LOCAL_USER_SESSION_KEY
0x40000007STATUS_BAD_CURRENT_DIRECTORY
0x40000008STATUS_SERIAL_MORE_WRITES
0x40000009STATUS_REGISTRY_RECOVERED
0x4000000ASTATUS_FT_READ_RECOVERY_FROM_BACKUP
0x4000000BSTATUS_FT_WRITE_RECOVERY
0x4000000CSTATUS_SERIAL_COUNTER_TIMEOUT
0x4000000DSTATUS_NULL_LM_PASSWORD
0x4000000ESTATUS_IMAGE_MACHINE_TYPE_MISMATCH
0x4000000FSTATUS_RECEIVE_PARTIAL
0x40000010STATUS_RECEIVE_EXPEDITED
0x40000011STATUS_RECEIVE_PARTIAL_EXPEDITED
0x40000012STATUS_EVENT_DONE
0x40000013STATUS_EVENT_PENDING
0x40000014STATUS_CHECKING_FILE_SYSTEM
0x40000015STATUS_FATAL_APP_EXIT
0x40000016STATUS_PREDEFINED_HANDLE
0x40000017STATUS_WAS_UNLOCKED
0x40000018STATUS_SERVICE_NOTIFICATION
0x40000019STATUS_WAS_LOCKED
0x4000001ASTATUS_LOG_HARD_ERROR
0x4000001BSTATUS_ALREADY_WIN32
0x4000001CSTATUS_WX86_UNSIMULATE
0x4000001DSTATUS_WX86_CONTINUE
0x4000001ESTATUS_WX86_SINGLE_STEP
0x4000001FSTATUS_WX86_BREAKPOINT
0x40000020STATUS_WX86_EXCEPTION_CONTINUE
0x40000021STATUS_WX86_EXCEPTION_LASTCHANCE
0x40000022STATUS_WX86_EXCEPTION_CHAIN
0x40000023STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE
0x40000024STATUS_NO_YIELD_PERFORMED
0x40000025STATUS_TIMER_RESUME_IGNORED
0x40000026STATUS_ARBITRATION_UNHANDLED
0x40000027STATUS_CARDBUS_NOT_SUPPORTED

Warning (0x80000000 – 0xBFFFFFFF)#

CodeName
0x80000001STATUS_GUARD_PAGE_VIOLATION
0x80000002STATUS_DATATYPE_MISALIGNMENT
0x80000003STATUS_BREAKPOINT
0x80000004STATUS_SINGLE_STEP
0x80000005STATUS_BUFFER_OVERFLOW
0x80000006STATUS_NO_MORE_FILES
0x80000007STATUS_WAKE_SYSTEM_DEBUGGER
0x8000000ASTATUS_HANDLES_CLOSED
0x8000000BSTATUS_NO_INHERITANCE
0x8000000CSTATUS_GUID_SUBSTITUTION_MADE
0x8000000DSTATUS_PARTIAL_COPY
0x8000000ESTATUS_DEVICE_PAPER_EMPTY
0x8000000FSTATUS_DEVICE_POWERED_OFF
0x80000010STATUS_DEVICE_OFF_LINE
0x80000011STATUS_DEVICE_BUSY
0x80000012STATUS_NO_MORE_EAS
0x80000013STATUS_INVALID_EA_NAME
0x80000014STATUS_EA_LIST_INCONSISTENT
0x80000015STATUS_INVALID_EA_FLAG
0x80000016STATUS_VERIFY_REQUIRED
0x80000017STATUS_EXTRANEOUS_INFORMATION
0x80000018STATUS_RXACT_COMMIT_NECESSARY
0x8000001ASTATUS_NO_MORE_ENTRIES
0x8000001BSTATUS_FILEMARK_DETECTED
0x8000001CSTATUS_MEDIA_CHANGED
0x8000001DSTATUS_BUS_RESET
0x8000001ESTATUS_END_OF_MEDIA
0x8000001FSTATUS_BEGINNING_OF_MEDIA
0x80000020STATUS_MEDIA_CHECK
0x80000021STATUS_SETMARK_DETECTED
0x80000022STATUS_NO_DATA_DETECTED
0x80000023STATUS_REDIRECTOR_HAS_OPEN_HANDLES
0x80000024STATUS_SERVER_HAS_OPEN_HANDLES
0x80000025STATUS_ALREADY_DISCONNECTED
0x80000026STATUS_LONGJUMP
0x80000027STATUS_CLEANER_CARTRIDGE_INSTALLED
0x80000028STATUS_PLUGPLAY_QUERY_VETOED
0x80000029STATUS_UNWIND_CONSOLIDATE
0x8000002ASTATUS_REGISTRY_HIVE_RECOVERED
0x8000002BSTATUS_DLL_MIGHT_BE_INSECURE

Error (0xC0000000 – 0xFFFFFFFF)#

CodeName
0xC0000001STATUS_UNSUCCESSFUL
0xC0000002STATUS_NOT_IMPLEMENTED
0xC0000003STATUS_INVALID_INFO_CLASS
0xC0000004STATUS_INFO_LENGTH_MISMATCH
0xC0000005STATUS_ACCESS_VIOLATION
0xC0000006STATUS_IN_PAGE_ERROR
0xC0000007STATUS_PAGEFILE_QUOTA
0xC0000008STATUS_INVALID_HANDLE
0xC0000009STATUS_BAD_INITIAL_STACK
0xC000000ASTATUS_BAD_INITIAL_PC
0xC000000BSTATUS_INVALID_CID
0xC000000CSTATUS_TIMER_NOT_CANCELED
0xC000000DSTATUS_INVALID_PARAMETER
0xC000000ESTATUS_NO_SUCH_DEVICE
0xC000000FSTATUS_NO_SUCH_FILE
0xC0000010STATUS_INVALID_DEVICE_REQUEST
0xC0000011STATUS_END_OF_FILE
0xC0000012STATUS_WRONG_VOLUME
0xC0000013STATUS_NO_MEDIA_IN_DEVICE
0xC0000014STATUS_UNRECOGNIZED_MEDIA
0xC0000015STATUS_NONEXISTENT_SECTOR
0xC0000016STATUS_MORE_PROCESSING_REQUIRED
0xC0000017STATUS_NO_MEMORY
0xC0000018STATUS_CONFLICTING_ADDRESSES
0xC0000019STATUS_NOT_MAPPED_VIEW
0xC000001ASTATUS_UNABLE_TO_FREE_VM
0xC000001BSTATUS_UNABLE_TO_DELETE_SECTION
0xC000001CSTATUS_INVALID_SYSTEM_SERVICE
0xC000001DSTATUS_ILLEGAL_INSTRUCTION
0xC000001ESTATUS_INVALID_LOCK_SEQUENCE
0xC000001FSTATUS_INVALID_VIEW_SIZE
0xC0000020STATUS_INVALID_FILE_FOR_SECTION
0xC0000021STATUS_ALREADY_COMMITTED
0xC0000022STATUS_ACCESS_DENIED
0xC0000023STATUS_BUFFER_TOO_SMALL
0xC0000024STATUS_OBJECT_TYPE_MISMATCH
0xC0000025STATUS_NONCONTINUABLE_EXCEPTION
0xC0000026STATUS_INVALID_DISPOSITION
0xC0000027STATUS_UNWIND
0xC0000028STATUS_BAD_STACK


Sourced from Windows 11 25H2 (build 26100) ntstatus.h: 2,843 codes total.