| Previous | Next |
| ERROR_DS_NOT_AN_OBJECT | ERROR_DS_SEC_DESC_INVALID |
ERROR_DS_SEC_DESC_TOO_SHORT
The security descriptor is structurally truncated
Active Directory stores nTSecurityDescriptor in Windows SECURITY_DESCRIPTOR format. For directory transport and storage, a self-relative descriptor contains a header with offsets to owner, group, SACL, and DACL data. A buffer that is too short cannot contain the mandatory structure or the data addressed by those fields, so the directory rejects it before ordinary permission semantics are evaluated.
Inspect how the client obtained and serialized the descriptor. Do not treat binary security descriptors as null-terminated strings or copy only the fixed header. If an LDAP library returns an octet string, preserve the exact byte length. Reconstructing a descriptor from SDDL should use Windows security APIs that emit a valid self-relative representation.
What to inspect
- Record the exact byte length submitted for nTSecurityDescriptor.
- Validate the SECURITY_DESCRIPTOR header and self-relative control bit.
- Use security APIs for serialization instead of hand-building offsets.
References
- MS-DTYP: SECURITY_DESCRIPTOR binary format
- MS-ADTS: security descriptor requirements
- MS-ADTS: constraints on Active Directory Add operations
Looking for a different code? Search another status or error code.