NTSTATUS Bit Field Decoder

Decode an NTSTATUS value into its Severity, Facility, and Code fields

Every NTSTATUS value is a 32-bit integer with a defined bit layout. The top two bits encode the severity (Success, Informational, Warning, or Error), bit 29 is the Customer flag that distinguishes Microsoft-defined codes from vendor-defined ones, bits 27–16 encode the facility (the subsystem that originated the status), and the low 16 bits are the status code within that facility.

Understanding this structure is useful when you encounter an unfamiliar NTSTATUS value in a kernel debugger or crash dump — even without a named symbol, the severity and facility tell you what kind of error occurred and which subsystem reported it.

Struggling with an unfamiliar NTSTATUS error in your driver? Our engineers have analyzed thousands of crash dumps and can help pinpoint the root cause. Learn about our debugging services or view the complete NTSTATUS code list.

• What our customers say about us?

  

  Read our customer testimonials to find out why our clients keep returning for their projects.

  View Testimonials