What does Windows error code 1306 (ERROR_REVISION_MISMATCH) mean?

 
Previous Next
ERROR_UNKNOWN_REVISION ERROR_INVALID_OWNER

ERROR_REVISION_MISMATCH

The requested security operation combines incompatible revisions.

ERROR_REVISION_MISMATCH is Win32 error 1306 (0x51A). It indicates that two revision levels are incompatible. A common security example is adding an object-specific ACE to an ACL whose revision does not support that ACE type.

How the mismatch is introduced

  • an ACL was initialized with an older revision and later receives a newer ACE form
  • code copies an ACE from one ACL without preserving compatibility requirements
  • a serialized descriptor is merged with objects created by another library version
  • an audit ACE and access ACE are built under inconsistent revision assumptions
  • the caller passes the revision of a descriptor where an ACL revision is required

Evidence to collect

Log the destination ACL revision, ACE revision requirement, ACE type and flags, ACL size, current ACE count, API name, and source of each structure. Preserve the original descriptor and the proposed modification. A textual SDDL rendering is useful, but retain binary metadata because not every compatibility detail is obvious in text.

Diagnostic sequence

Enumerate the destination ACL and determine the highest revision required by its existing and proposed ACEs. Review the documentation for the exact add-ACE function; object-specific ACE functions require an appropriate ACL revision. Rebuild the ACL in a new buffer rather than modifying a layout whose provenance is uncertain.

Validate the rebuilt ACL before applying it to an object. Keep canonical ACE ordering and enough space for alignment. When merging descriptors from different sources, normalize them through supported APIs instead of concatenating binary ACE data.

Recovery

Create a compatible ACL revision, copy valid existing ACEs, add the new ACE with its documented flags, validate the result, and then replace the object’s ACL atomically through the security API. If the target platform does not support the required ACE semantics, omit the feature or use a documented fallback rather than falsifying the revision.

Difference from unknown revision

ERROR_UNKNOWN_REVISION means a revision value cannot be recognized at all. Error 1306 means the revisions have meaning but cannot be used together for the requested operation. The distinction helps decide whether to repair a corrupted header or rebuild a structure at a newer supported revision.

Example

An auditing tool initializes an ACL with the basic revision, then calls an object-audit ACE function containing GUID-specific inheritance data. The API returns 1306. Reconstructing the ACL with the object-capable revision allows the ACE to be represented correctly.

References

Looking for a different code? Search another status or error code.