| Previous | Next |
| STATUS_CANNOT_GRANT_REQUESTED_OPLOCK | STATUS_DEVICE_SUPPORT_IN_PROGRESS |
STATUS_NO_ACE_CONDITION
The ACE has no condition to evaluate
Conditional access rules are carried by callback ACE types whose application data encodes an expression. This status means the selected ACE does not contain that expression. It is different from an expression that evaluates to false and from a malformed condition that cannot be parsed.
Inspect the ACE type before interpreting the result. Ordinary allow and deny ACEs never contain conditional bytecode, while a callback ACE may be unconditional if its application data is empty. Code that expects dynamic access control should not silently treat an absent condition as a successful match.
What to inspect
- Dump the complete ACL and identify the exact ACE type and flags.
- Compare the binary ACE with its SDDL or policy source rather than reconstructing it from display text.
- Decide whether an unconditional callback ACE is intentional; otherwise regenerate the security descriptor from the authoritative policy.
References
- Microsoft Open Specifications: SDDL and ACE syntax
- Microsoft Open Specifications: conditional ACE representation
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.