| Previous | Next |
| ERROR_BAD_TOKEN_TYPE | ERROR_CANT_ACCESS_DOMAIN_INFO |
ERROR_NO_SECURITY_ON_OBJECT
A security API was asked to operate on an object that does not expose associated security information
Windows access control is based on security descriptors containing owner/group information and optional DACL/SACL data. Some object abstractions or private resource-manager objects may not have security attached in the form expected by the requested API. This error is different from access denied: there is no descriptor in the relevant object security model to evaluate or modify.
Confirm the object type and the API used to retrieve or change security. Generic named-object security functions only support documented SE_OBJECT_TYPE categories, while private resource managers are responsible for maintaining descriptors for their own objects. If the object is newly created, verify initialization and inheritance paths. Do not synthesize a blank DACL as a generic workaround: a NULL DACL has permissive semantics and can change security dramatically. First determine which component owns the object security contract.
What to inspect
- Identify the object type and the security API/object category used.
- Verify descriptor initialization for newly created or private objects.
- Do not replace missing security with a NULL DACL as a generic repair.
References
- MS-DTYP: SECURITY_DESCRIPTOR
- Microsoft: securitybaseapi functions
- Microsoft: checking access to private objects
Looking for a different code? Search another status or error code.