| Previous | Next |
| STATUS_REVISION_MISMATCH | STATUS_INVALID_PRIMARY_GROUP |
STATUS_INVALID_OWNER
The proposed owner SID is not valid for this assignment
An owner is not an arbitrary SID string. Normally the SID must represent the token user or a token group marked as owner-capable, unless the caller holds and enables the privilege that permits taking or restoring ownership. A syntactically valid SID can therefore still be rejected for ownership.
Inspect the caller token and the owner field before serializing or applying the descriptor. Do not solve the failure by replacing the owner with Everyone or another broad group; ownership controls the ability to change discretionary security and should reflect the intended administrator or principal.
What to inspect
- Validate the SID and confirm it is present in the caller token with suitable attributes.
- Check whether SeRestorePrivilege or SeTakeOwnershipPrivilege is required and enabled.
- Preserve the existing owner when only DACL or SACL changes are intended.
References
- Microsoft: GetSecurityDescriptorOwner
- Microsoft: Security descriptors
- Microsoft: TOKEN_GROUPS
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.