Deciphering mysterious Microsoft error codes with err.exe tool

Deciphering mysterious Microsoft error codes with err.exe tool

We’ve all been there. There is some big problem, everyone’s mad at you and all you’ve got is some useless looking hexadecimal error code.

That is where the err.exe program comes in (go ahead and go download/install it from that link I just gave you, or use chocolatey my preferred method)

For example:  Let’s say you got this error in eventlog: 

Automatic registration failed. Failed to lookup the registration service information from Active Directory. Exit code: Unknown HResult Error code: 0x801c001d. See 

You simply type in Err.exe 0x801c001d 

(It will spit a lot of stuff, but if you look carefully you’ll see what you are looking for, I’ve highlighted it in bold for you. The column on the right is the source of the error, winerror.h is where you will want to look for most of them)

C:\Windows\system32>err.exe 0x801c001d
# No results found for hex 0x801c001d / decimal -2145648611
# anonymous HRESULT: Severity: FAILURE (1), Facility 0x1c, Code 0x1d
# for hex 0x1d / decimal 29
  BTH_ERROR_SCO_AIRMODE_REJECTED                                 bthdef.h
  NO_SPIN_LOCK_AVAILABLE                                         bugcodes.h
  CR_REGISTRY_ERROR                                              cfgmgr32.h
  POLICY_ERRV_SUBNET_DEF_PEAK_RATE                               lpmapi.h
  MSIDBERROR_BADLOCALIZEATTRIB                                   msiquery.h
# invalid localization attribute (primary keys cannot be
# localized)
  NMERR_ADDRESS_NOT_FOUND                                        netmon.h
  OLE_ERROR_NAME                                                 ole.h
# Invalid name(doc name object name)    */
  SE_ERR_DDEFAIL                                                 shellapi.h
  ERROR_WRITE_FAULT                                              winerror.h
# The system cannot write to the specified device.
# 9 matches found for "0x801c001d"

That pulls all of the different ones, but sometimes helps to narrow it down, so if you know the source (aka “table” as they call it, put that in like below)

C:\Windows\system32>err.exe /winerror.h /ntstatus.h 0x801c001d
# winerror.h selected.
# ntstatus.h selected.
# No results found for hex 0x801c001d / decimal -2145648611
# anonymous HRESULT: Severity: FAILURE (1), Facility 0x1c, Code 0x1d
# for hex 0x1d / decimal 29
  ERROR_WRITE_FAULT                                              winerror.h
# The system cannot write to the specified device.
# 1 matches found for "0x801c001d"

You can search Microsoft’s documentation for more info on the individual tables.

Typing err.exe /? will as usual give you a list of all the options: (Note, this gets updated with time)

C:\Windows\system32>err.exe /?
Table ? could not be found.

USAGE: C:\ProgramData\chocolatey\lib\err\err.exe [opt] {value} [value] [value] ...
 where <value> must be of one of the following forms:
   1. decorated hex (0x54f)
   2. implicit hex  (54f)
   3. ambiguous     (1359)
   4. exact string  (=ERROR_INTERNAL_ERROR)
   5. substring     (:INTERNAL_ERROR)
...and <opt> may be one of:
   /:xml         - causes the output to be in XML-parseable form.
                   To understand the output, try it.  It's pretty obvious.
   /:listTables  - lists all the tables below in XML format.
                   Again, the format is pretty straightforward.
   /:outputtoCSV - lists all the tables below in CSV format.
   /:outputtoJS  - lists all the tables below for use in JS.
   /:outputtoCPP - lists all the tables below for a C++ header.
   /:hresultfromwin32 - prints HRESULT_FROM_WIN32 errors for a C++ header.

All values on the command line will be looked up in our internal
tables and presented to you.  If available, informational data
associated with the value(s) will also be shown (see below).
All tables are searched by default, but you can restrict the
output to those tables you deem appropriate by adding
"/<tablename>" to the beginning of the commandline.


> err /winerror.h /ntstatus.h 0
# winerror.h selected.
# ntstatus.h selected.
# for hex 0x0 / decimal 0 :
  STATUS_WAIT_0                                             ntstatus.h
  ERROR_SUCCESS                                             winerror.h
# The operation completed successfully.
  NO_ERROR                                                  winerror.h
  SEC_E_OK                                                  winerror.h
  S_OK                                                      winerror.h
# 5 matches found for "0"

This app has support derived from the following headers and privates:

  activprof.h             activscp.h             adoint.h               adserr.h
  asferr.h                audioclient.h          audioenginebaseapo.h   bitsmsg.h
  bthdef.h                bugcodes.h             cderr.h                cdosyserr.h
  cfgmgr32.h              cierror.h              corerror.h             corsym.h
  ctffunc.h               d3d.h                  d3d9.h                 d3d9helper.h
  d3dx10.h                d3dx10core.h           d3dx9.h                d3dx9xof.h
  daogetrw.h              dbdaoerr.h             dciddi.h               ddeml.h
  ddraw.h                 dhcpssdk.h             difxapi.h              dinput.h
  dinputd.h               dlnaerror.h            dmerror.h              drt.h
  dsound.h                dxfile.h               eaphosterror.h         ehstormsg.h
  esent.h                 fherrors.h             filterr.h              fltdefs.h
  hidpi.h                 iiscnfg.h              imapi2error.h          imapi2fserror.h
  imapierror.h            ime.h                  intshcut.h             ipexport.h
  iscsierr.h              iscsilog.h             jscript9diag.h         legacyErrorCodes.h
  lmerr.h                 lmerrlog.h             lmsvc.h                lpmapi.h
  lzexpand.h              mciavi.h               mdmregistration.h      mdmsg.h
  mediaerr.h              mferror.h              mmstream.h             mobsync.h
  mpeg2error.h            mprerror.h             mq.h                   mqoai.h
  msctf.h                 msdrmerror.h           msime.h                msiquery.h
  msopc.h                 mswmdm.h               msxml2.h               nb30.h
  ndattrib.h              netcfgx.h              netevent.h             netmon.h
  netsh.h                 nserror.h              ntdddisk.h             ntdsapi.h
  ntdsbmsg.h              ntiologc.h             ntstatus.h             odbcinst.h
  ole.h                   olectl.h               oledberr.h             oledlg.h
  p2p.h                   patchapi.h             patchwiz.h             pbdaerrors.h
  pdhmsg.h                photoacquire.h         portabledevice.h       qossp.h
  raserror.h              rdcentraldb.h          reconcil.h             routprot.h
  rtcerr.h                sberrors.h             scesvc.h               schannel.h
  setupapi.h              shellapi.h             sherrors.h             shimgdata.h
  shobjidl_core.h         slerror.h              snmp.h                 spatialaudioclient.h
  spatialaudiometadata.h  sperror.h              stierr.h               synchronizationerrors.h
  tapi.h                  tapi3err.h             tcerror.h              textserv.h
  textstor.h              thumbcache.h           tpcerror.h             txdtc.h
  upnp.h                  upnphost.h             urlmon.h               usb.h
  usp10.h                 vdserr.h               vfw.h                  vfwmsgs.h
  vsserror.h              wbemcli.h              wcmerrors.h            wcntypes.h
  wdfstatus.h             wdscpmsg.h             wdsmcerr.h             wdstptmgmtmsg.h
  werapi.h                wiadef.h               winbio_err.h           wincrypt.h
  windowsplayready.h      windowssearcherrors.h  winerror.h             winfax.h
  winhttp.h               wininet.h              winioctl.h             winldap.h
  winsnmp.h               winsock2.h             winspool.h             wpc.h
  wsbapperror.h           wsmerror.h             wuerror.h              xapo.h
  xaudio2.h               xmllite.h              xpsdigitalsignature.h  xpsobjectmodel.h
There are currently 25259 return codes registered from 173 sources.

Of course this is all documented out on Microsoft very good documentation , but we like to try to keep things simple here. (Heck you could probably just browse there to find the code too)

(By the way, I do really mean that they have good documentation, some of the best around. But it’s still a chore to read sometimes.)

At the end of the day it’s probably still just as easy to google it, but there are cases where this does help. Also you have it create csv files etc… so if you wanted to automate some things, you probably could, but that is beyond the scope of this article.

Hopefully now you’ve got some ideas how to fix whatever problem you are working on and soon can go back to not being yelled at anymore. Enjoy the rest of your day and may the Lord Bless you!

Featured Image by Gerd Altmann from Pixabay

Leave a Reply

Your email address will not be published. Required fields are marked *