| Previous | Next |
| ERROR_APP_HANG | ERROR_NOT_ALL_ASSIGNED |
ERROR_INVALID_LABEL
The supplied security identifier cannot be used as an object label.
ERROR_INVALID_LABEL is Win32 error 1299 (0x513). It indicates that a particular SID may not be assigned as the label of an object. In Mandatory Integrity Control, integrity labels use specially formed SIDs stored in a SYSTEM_MANDATORY_LABEL_ACE within the object’s SACL.
Common label construction errors
- using an ordinary user or group SID instead of the mandatory-label authority
- placing a label ACE in a DACL rather than the SACL
- supplying an unsupported integrity RID or malformed SID length
- building an ACE with the wrong type, revision, or access-policy mask
- attempting to relabel an object without the required privilege or object support
Useful evidence
Record the object type and path, binary SID and SDDL form, SID authority, subauthorities, ACE type, ACL revision, requested mandatory policy mask, caller token integrity level, and enabled privileges. Preserve the original security descriptor before modification so failed repair does not destroy valid auditing data.
Troubleshooting steps
Validate the SID with supported SID routines and confirm that its identifier authority is SECURITY_MANDATORY_LABEL_AUTHORITY. Parse the SACL and verify that the label uses SYSTEM_MANDATORY_LABEL_ACE_TYPE. Check the integrity RID against the intended low, medium, high, system, or other supported level.
Use security-descriptor APIs instead of editing self-relative structures by pointer. Confirm that the object accepts mandatory labels and that the caller holds the access rights and SeRelabelPrivilege required for the operation. A privilege failure should be reported separately from a malformed label.
Recovery
Construct a valid mandatory-label ACE, merge it into a correctly revised SACL, and apply it through the documented security API. If the intent is ordinary discretionary access control, place the user or group SID in a DACL ACE instead of forcing it into the label field.
Difference from revision errors
ERROR_UNKNOWN_REVISION means the descriptor or textual security format uses an unknown revision. ERROR_REVISION_MISMATCH means known revisions are incompatible. Error 1299 says the SID itself is not acceptable as the requested object label.
Example
A sandbox setup routine copies the service account SID into a mandatory-label ACE, assuming any SID can represent integrity. The security API returns 1299. Replacing it with the correct low-integrity SID and policy mask creates the intended write restriction.
References
Looking for a different code? Search another status or error code.