| Previous | Next |
| SEC_E_INVALIDOWNER | DB_E_BADINDEXID |
SEC_E_INVALIDACCESSENTRY
Meaning
Windows documents SEC_E_INVALIDACCESSENTRY as “Permission in the access entry list is invalid”. In this case, one access-control entry specifies a permission, trustee or access mode invalid for the target object.
Conditions that specifically lead to the result
- Cause 1: the access right does not apply to the object type.
- Cause 2: the allow or deny mode is unsupported.
- Cause 3: the entry combines a valid trustee with malformed property or inheritance data.
Relevant contract
OLE DB security administration represents trustees, owners, groups, protected objects and access-entry lists as separate entities. A syntactically valid trustee can still be unknown to a provider, and an allowed permission set depends on the protected object type.
Investigation of this result should start with the provider security interface, effective data-source namespace and exact trustee or access-entry structure supplied.
Diagnostic sequence
- Identify the exact failing stage: one access-control entry specifies a permission, trustee or access mode invalid for the target object.
Evidence to collect
- Evidence 1: entry index and redacted trustee.
- Evidence 2: requested access mask and mode.
- Evidence 3: supported rights for the protected object type.
Corrective actions
- Action 1: remove or translate unsupported rights.
- Action 2: validate each entry before assembling the list.
- Action 3: report the exact rejected entry to policy tooling.
Practical scenario
A table ACL includes a file-system-specific right; mapping permissions to provider rights prevents it.
Retry and recovery
Retry rule: retry after replacing the individual entry with one valid for the target object.
Difference from nearby HRESULT values
SEC_E_INVALIDACCESSENTRYLIST rejects the whole list structure, while SEC_E_INVALIDACCESSENTRY identifies a particular entry.
Official Microsoft references
Looking for a different code? Search another status or error code.