2.1 HRESULT

The HRESULT numbering space is vendor-extensible. Vendors can supply their own values for this field, as long as the C bit (0x20000000) is set, indicating it is a customer code.

The HRESULT numbering space has the following internal structure. Any protocol that uses NTSTATUS values on the wire is responsible for stating the order in which the bytes are placed on the wire.

S (1 bit): Severity. If set, indicates a failure result. If clear, indicates a success result.

R (1 bit): Reserved. If the N bit is clear, this bit MUST be set to 0. If the N bit is set, this bit is defined by the NTSTATUS numbering space (as specified in section 2.3).

C (1 bit): Customer. This bit specifies if the value is customer-defined or Microsoft-defined. The bit is set for customer-defined values and clear for Microsoft-defined values.<1>

N (1 bit): If set, indicates that the error code is an NTSTATUS value (as specified in section 2.3), except that this bit is set.

X (1 bit): Reserved. SHOULD be set to 0. <2>

Facility (11 bits): An indicator of the source of the error. New facilities are occasionally added by Microsoft.

The following table lists the currently defined facility codes:

Value	Meaning
FACILITY_NULL 0	The default facility code.
FACILITY_RPC 1	The source of the error code is an RPC subsystem.
FACILITY_DISPATCH 2	The source of the error code is a COM Dispatch.
FACILITY_STORAGE 3	The source of the error code is OLE Storage.
FACILITY_ITF 4	The source of the error code is COM/OLE Interface management.
FACILITY_WIN32 7	This region is reserved to map undecorated error codes into HRESULTs.
FACILITY_WINDOWS 8	The source of the error code is the Windows subsystem.
FACILITY_SECURITY 9	The source of the error code is the Security API layer.
FACILITY_SSPI 9	The source of the error code is the Security API layer.
FACILITY_CONTROL 10	The source of the error code is the control mechanism.
FACILITY_CERT 11	The source of the error code is a certificate client or server?
FACILITY_INTERNET 12	The source of the error code is Wininet related.
FACILITY_MEDIASERVER 13	The source of the error code is the Windows Media Server.
FACILITY_MSMQ 14	The source of the error code is the Microsoft Message Queue.
FACILITY_SETUPAPI 15	The source of the error code is the Setup API.
FACILITY_SCARD 16	The source of the error code is the Smart-card subsystem.
FACILITY_COMPLUS 17	The source of the error code is COM+.
FACILITY_AAF 18	The source of the error code is the Microsoft agent.
FACILITY_URT 19	The source of the error code is .NET CLR.
FACILITY_ACS 20	The source of the error code is the audit collection service.
FACILITY_DPLAY 21	The source of the error code is Direct Play.
FACILITY_UMI 22	The source of the error code is the ubiquitous memoryintrospection service.
FACILITY_SXS 23	The source of the error code is Side-by-side servicing.
FACILITY_WINDOWS_CE 24	The error code is specific to Windows CE.
FACILITY_HTTP 25	The source of the error code is HTTP support.
FACILITY_USERMODE_COMMONLOG 26	The source of the error code is common Logging support.
FACILITY_USERMODE_FILTER_MANAGER 31	The source of the error code is the user mode filter manager.
FACILITY_BACKGROUNDCOPY 32	The source of the error code is background copy control
FACILITY_CONFIGURATION 33	The source of the error code is configuration services.
FACILITY_STATE_MANAGEMENT 34	The source of the error code is state management services.
FACILITY_METADIRECTORY 35	The source of the error code is the Microsoft Identity Server.
FACILITY_WINDOWSUPDATE 36	The source of the error code is a Windows update.
FACILITY_DIRECTORYSERVICE 37	The source of the error code is Active Directory.
FACILITY_GRAPHICS 38	The source of the error code is the graphics drivers.
FACILITY_SHELL 39	The source of the error code is the user Shell.
FACILITY_TPM_SERVICES 40	The source of the error code is the Trusted Platform Module services.
FACILITY_TPM_SOFTWARE 41	The source of the error code is the Trusted Platform Module applications.
FACILITY_PLA 48	The source of the error code is Performance Logs and Alerts
FACILITY_FVE 49	The source of the error code is Full volume encryption.
FACILITY_FWP 50	he source of the error code is the Firewall Platform.
FACILITY_WINRM 51	The source of the error code is the Windows Resource Manager.
FACILITY_NDIS 52	The source of the error code is the Network Driver Interface.
FACILITY_USERMODE_HYPERVISOR 53	The source of the error code is the Usermode Hypervisor components.
FACILITY_CMI 54	The source of the error code is the Configuration Management Infrastructure.
FACILITY_USERMODE_VIRTUALIZATION 55	The source of the error code is the user mode virtualization subsystem.
FACILITY_USERMODE_VOLMGR 56	The source of the error code is the user mode volume manager
FACILITY_BCD 57	The source of the error code is the Boot Configuration Database.
FACILITY_USERMODE_VHD 58	The source of the error code is user mode virtual hard disk support.
FACILITY_SDIAG 60	The source of the error code is System Diagnostics.
FACILITY_WEBSERVICES 61	The source of the error code is the Web Services.
FACILITY_WINDOWS_DEFENDER 80	The source of the error code is a Windows Defender component.
FACILITY_OPC 81	The source of the error code is the open connectivity service.

Code (2 bytes): The remainder of the error code.