What does NTSTATUS 0xC0000446 (STATUS_INVALID_LABEL) mean?

STATUS_INVALID_LABEL

Mandatory integrity labels use a restricted SID authority and RID set

STATUS_INVALID_LABEL concerns the mandatory label of a securable object, not its ordinary owner or DACL trustee. Windows Mandatory Integrity Control stores an object’s integrity SID in a SYSTEM_MANDATORY_LABEL_ACE inside the SACL. Microsoft documents that the SID authority for this ACE must be SECURITY_MANDATORY_LABEL_AUTHORITY and that the RID identifies an integrity level.

Inspect the label ACE being constructed or restored. A normal user SID, group SID, service SID, or arbitrary SID string cannot be substituted for an integrity SID simply because it is syntactically valid. Also check the ACE type and SACL placement: a mandatory label is represented differently from an access-allowed or access-denied ACE in the DACL.

This distinction matters in backup, security-descriptor transformation and cross-platform SMB tooling. Preserve the original descriptor and compare the label SID and mandatory policy bits with a descriptor produced by Windows for an object at the intended integrity level. Do not remove the SACL or convert the label into a discretionary ACE; that changes the security model rather than correcting the invalid label.

What to inspect

• The SID authority and RID of the label SID, plus the complete SYSTEM_MANDATORY_LABEL_ACE header and policy mask.
• Whether the ACE is in the SACL and whether the descriptor transformation accidentally treated a user/group SID as an integrity label.
• The source and destination security descriptors in restore, SMB, or migration code, compared with a native Windows descriptor at the same integrity level.

References

• Microsoft: Mandatory Integrity Control
• Microsoft: SYSTEM_MANDATORY_LABEL_ACE
• Microsoft Open Specifications: MandatoryIntegrityCheck algorithm
• Microsoft: Security descriptors
• Microsoft Open Specifications: NTSTATUS values

Looking for a different code? Search another status or error code.