No mapping between account names and security IDs was done

Or, Friday Afternoon Stupidity

I spent a good two hours staring at that message.

Well, ok, i did a lot of other things during that time also, but still, for those two hours, staring at that message was happening fairly often.

See, i was throwing in a bit of code that would disable certain features if the user wasn't a member of certain groups on the domain. The idea seemed slick, we'd use build-in Windows authentication, and so wouldn't have to distribute encrypted files, or set up our own server, or anything troublesome like that... just check if the user is in this group, and if not disable stuff.

Well, it sounded easy. And it would have been too, except i've never worked with any of this before. The most i've ever done with regards to Windows security was to do a string comparison to the result of GetUserName(). So i started Googling for info on it, and after maybe an hour of reading about LookupAccountName() and CheckTokenMembership(), i had a routine that seemed to do what i wanted, at least with local groups. Smiling, i changed the group to check against to one on the domain... Failure. "No mapping between account names and security IDs was done." To quote a veteran Windows developer, "Blast!"

So now what? I go and bring up the MSDN page for each function i'm calling, double check that the parameters are of the right type and of the right size. I re-write the memory allocation to simplify it, just in case that's causing problems. I start searching newsgroups for that error message. I list all the groups available on the domain, just in case i'd gotten the name wrong for the one i'd tried.

Finally, i read a thread that ends with the original author seeing success and admitting that it was due to a rogue space in the username. Well, i think, that can't be it, 'cause the name is hard-coded, and any spaces would be obvious next to the quotes... and as i'm thinking this, i'm already seeing the problem.

Yup. I'd only used one backslash to separate the domain and the group. Once that was escaped, everything works beautifully.