What does Windows error code 1336 (ERROR_INVALID_ACL) mean?

 
Previous Next
ERROR_INVALID_SUB_AUTHORITY ERROR_INVALID_SID

ERROR_INVALID_ACL

ERROR_INVALID_ACL (1336, 0x00000538) means that an access control list has an invalid binary layout. This is a data-structure error, not a normal access-denied decision.

What Windows validates

An ACL contains a revision, a total size, and a count of access control entries. IsValidAcl checks the revision and verifies that the entry count fits within the declared ACL size. A buffer that was not initialized correctly, has an incorrect length, or was overwritten can therefore produce this error.

How to prevent it

  • Create new ACLs with InitializeAcl and add entries through the documented ACL APIs instead of writing the binary fields directly.
  • Calculate and retain the buffer size needed for the ACL, including every ACE and SID.
  • Validate an externally received or deserialized ACL before attaching it to a security descriptor.
  • Keep the ACL buffer alive for as long as a security descriptor refers to it.

See Microsoft documentation for IsValidAcl and access control lists.

Looking for a different code? Search another status or error code.