| Previous | Next |
| ERROR_DS_SEC_DESC_TOO_SHORT | ERROR_DS_NO_DELETED_NAME |
ERROR_DS_SEC_DESC_INVALID
The security descriptor has an invalid structure or directory-specific field
A buffer can be long enough yet still fail security descriptor validation. MS-DTYP defines the SECURITY_DESCRIPTOR fields, control bits, SIDs, and ACL offsets. MS-ADTS adds directory requirements: descriptors stored by a DC are maintained in the defined format, the owner SID cannot be NULL, and Active Directory applies inheritance and resource-manager rules.
Validate the descriptor before sending it to LDAP. Check self-relative format, offsets, SID structures, ACL and ACE lengths, control flags, and owner presence. If the client intends to change only selected security information, use the supported security-descriptor controls or directory APIs rather than copying an opaque descriptor from a different object and patching bytes.
What to inspect
- Run Windows security descriptor validation on the exact binary value.
- Inspect owner, group, DACL, SACL, and control flags separately.
- Avoid byte-level edits to inherited ACEs or self-relative offsets.
References
- MS-DTYP: SECURITY_DESCRIPTOR binary format
- MS-ADTS: security descriptor requirements
- MS-ADTS: LDAP extended controls supported by Active Directory
Looking for a different code? Search another status or error code.