What does Windows error code 1299 (ERROR_INVALID_LABEL) mean?

 
Previous Next
ERROR_APP_HANG ERROR_NOT_ALL_ASSIGNED

ERROR_INVALID_LABEL

The supplied security identifier cannot be used as an object label.

ERROR_INVALID_LABEL is Win32 error 1299 (0x513). It indicates that a particular SID may not be assigned as the label of an object. In Mandatory Integrity Control, integrity labels use specially formed SIDs stored in a SYSTEM_MANDATORY_LABEL_ACE within the object’s SACL.

Common label construction errors

  • using an ordinary user or group SID instead of the mandatory-label authority
  • placing a label ACE in a DACL rather than the SACL
  • supplying an unsupported integrity RID or malformed SID length
  • building an ACE with the wrong type, revision, or access-policy mask
  • attempting to relabel an object without the required privilege or object support

Useful evidence

Record the object type and path, binary SID and SDDL form, SID authority, subauthorities, ACE type, ACL revision, requested mandatory policy mask, caller token integrity level, and enabled privileges. Preserve the original security descriptor before modification so failed repair does not destroy valid auditing data.

Troubleshooting steps

Validate the SID with supported SID routines and confirm that its identifier authority is SECURITY_MANDATORY_LABEL_AUTHORITY. Parse the SACL and verify that the label uses SYSTEM_MANDATORY_LABEL_ACE_TYPE. Check the integrity RID against the intended low, medium, high, system, or other supported level.

Use security-descriptor APIs instead of editing self-relative structures by pointer. Confirm that the object accepts mandatory labels and that the caller holds the access rights and SeRelabelPrivilege required for the operation. A privilege failure should be reported separately from a malformed label.

Recovery

Construct a valid mandatory-label ACE, merge it into a correctly revised SACL, and apply it through the documented security API. If the intent is ordinary discretionary access control, place the user or group SID in a DACL ACE instead of forcing it into the label field.

Difference from revision errors

ERROR_UNKNOWN_REVISION means the descriptor or textual security format uses an unknown revision. ERROR_REVISION_MISMATCH means known revisions are incompatible. Error 1299 says the SID itself is not acceptable as the requested object label.

Example

A sandbox setup routine copies the service account SID into a mandatory-label ACE, assuming any SID can represent integrity. The security API returns 1299. Replacing it with the correct low-integrity SID and policy mask creates the intended write restriction.

References


Looking for a different code? Search another status or error code.