| Previous | Next |
| STATUS_INVALID_OWNER | STATUS_NO_IMPERSONATION_TOKEN |
STATUS_INVALID_PRIMARY_GROUP
The primary-group SID is invalid for the object or caller
Windows security descriptors contain a primary-group field even though most Windows access checks do not use it like POSIX group ownership. The value still must be a valid SID and, for ordinary assignment, correspond to an appropriate group represented in the caller token or supplied through a privileged restore path.
Do not copy a primary-group field blindly between unrelated domains or tokens. Resolve the SID in the destination environment and distinguish this field from the owner and from DACL group ACEs. If interoperability software uses it for POSIX semantics, verify its own mapping rules as well.
What to inspect
- Validate SID structure and domain membership before applying the descriptor.
- Compare the proposed SID with groups in the caller token and required privileges.
- Keep owner, primary group, and DACL changes separate in diagnostics.
References
- Microsoft: Primary group in a security descriptor
- Microsoft: Security descriptors
- Microsoft: TOKEN_GROUPS
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.