What does HRESULT 0x80010139 (CO_E_EXCEEDSYSACLLIMIT) mean?

Previous	Next
CO_E_FAILEDTOCLOSEHANDLE	CO_E_ACESINWRONGORDER

CO_E_EXCEEDSYSACLLIMIT

ACL contains more ACEs than the system supports

CO_E_EXCEEDSYSACLLIMIT is HRESULT 2147549497 (0x80010139) from winerror.h. AllStat describes it as “The number of ACEs in an ACL exceeds the system limit.” In the COM IAccessControl, DCOM client identity, trustee translation, token inspection, security descriptor, ACL, or serialization workflow, the code identifies a specific failure boundary and should not be replaced by a generic COM exception.

A generic “operation failed” message is insufficient for CO_E_EXCEEDSYSACLLIMIT because the recovery decision depends on the exact lifecycle, security, marshaling, or state condition.

Diagnostic sequence

• Capture the raw unsigned value 0x80010139 and symbolic name CO_E_EXCEEDSYSACLLIMIT before a language projection, exception wrapper, or generic COM helper replaces it.
• Identify the exact interface, method, callback, activation request, metadata query, access-control operation, or marshaling boundary that returned CO_E_EXCEEDSYSACLLIMIT.
• Reconstruct the operation timeline for CO_E_EXCEEDSYSACLLIMIT, including object creation, thread or apartment initialization, security setup, callbacks, mutations, shutdown, and cleanup.
• Prove the decisive condition: duplicate, inherited, redundant, and obsolete ACEs are identified before any permissions are removed.
• Inspect every output parameter, handle, interface pointer, token, SID, ACL, stream, buffer, server-side object, or asynchronous result produced before CO_E_EXCEEDSYSACLLIMIT.
• Reproduce CO_E_EXCEEDSYSACLLIMIT with the smallest safe input, change only the suspected precondition, and verify that both the HRESULT and postcondition change as predicted.

Where it is encountered

• CO_E_EXCEEDSYSACLLIMIT can be returned during IAccessControl initialization, access checks, owner/trustee processing, and serialized ACL persistence. For CO_E_EXCEEDSYSACLLIMIT, record the interface, method, component version, thread, apartment, process, and correlation ID.
• CO_E_EXCEEDSYSACLLIMIT can be returned during server-side DCOM impersonation, client blanket inspection, token and SID lookup. For CO_E_EXCEEDSYSACLLIMIT, record the interface, method, component version, thread, apartment, process, and correlation ID.
• CO_E_EXCEEDSYSACLLIMIT can be returned during security descriptor construction, DACL canonicalization, file-backed policy storage, or legacy NetAccess migration. For CO_E_EXCEEDSYSACLLIMIT, record the interface, method, component version, thread, apartment, process, and correlation ID.

The immediate focus for CO_E_EXCEEDSYSACLLIMIT is a generated access-control list whose entry count or total size exceeds platform or consuming implementation limits. Keep CO_E_EXCEEDSYSACLLIMIT attached to that operation; the same numeric severity outside the owning API does not supply enough context.

Decisive interpretation boundary

Before choosing recovery, verify that duplicate, inherited, redundant, and obsolete ACEs are identified before any permissions are removed. The decisive boundary for CO_E_EXCEEDSYSACLLIMIT determines whether the same object can continue, a new object is required, or policy must change.

For CO_E_EXCEEDSYSACLLIMIT, also confirm that all observed objects, tokens, buffers, proxies, metadata files, or ACLs belong to the current operation generation and were not retained from an earlier attempt.

Evidence and telemetry

• Preserve ACL byte size and ACE count for CO_E_EXCEEDSYSACLLIMIT.
• Preserve explicit and inherited ACE counts for CO_E_EXCEEDSYSACLLIMIT.
• Preserve duplicate or equivalent entries for CO_E_EXCEEDSYSACLLIMIT.
• Preserve effective access before compaction for CO_E_EXCEEDSYSACLLIMIT.
• Preserve group-based replacement result for CO_E_EXCEEDSYSACLLIMIT.

For CO_E_EXCEEDSYSACLLIMIT, also record UTC time, process and thread IDs, apartment type, component version, security or package identity where relevant, and a correlation ID. For CO_E_EXCEEDSYSACLLIMIT, use hashes, lengths, GUIDs, and SID strings rather than logging confidential payloads or credentials.

Difference from nearby HRESULTs

CO_E_EXCEEDSYSACLLIMIT is capacity exhaustion; CO_E_ACESINWRONGORDER concerns canonical ordering of an otherwise representable ACL.

Tests for CO_E_EXCEEDSYSACLLIMIT should force both results and verify that object lifetime, output use, and user messaging differ.

Correct handling and recovery

Canonicalize and consolidate equivalent entries, use group-based authorization, and redesign overly granular policy. Preserve effective-access tests during compaction.

For CO_E_EXCEEDSYSACLLIMIT, reconcile partial output and server-side effects before attempting the operation again.

Practical scenario

A deployment adds one ACE per user until the DACL exceeds limits. Administration creates a security group and replaces thousands of user ACEs with one group ACE.

A regression test should reproduce CO_E_EXCEEDSYSACLLIMIT, assert the raw HRESULT and all relevant outputs, then correct only the decisive condition and verify the intended success or neighboring failure result.

Lifetime, retry, and cleanup rules

After CO_E_EXCEEDSYSACLLIMIT, determine whether the current object, interface pointer, call context, token, stream, metadata reader, asynchronous operation, or access-control instance remains valid. For CO_E_EXCEEDSYSACLLIMIT, release only resources owned by the failing attempt, cancel callbacks through their documented mechanism, and avoid double close, double commit, repeated activation, or replay of a non-idempotent remote method.

The retry policy for CO_E_EXCEEDSYSACLLIMIT should state the trigger, maximum attempts, cancellation owner, and reconciliation step for effects that may have completed elsewhere.

Developer and administrator guidance

A support bundle for CO_E_EXCEEDSYSACLLIMIT should include first-occurrence logs, interface and component identity, object generation, relevant policy, and safe hashes. For CO_E_EXCEEDSYSACLLIMIT, redact credentials, tokens, private metadata, ACL identities, and serialized payload contents.

After CO_E_EXCEEDSYSACLLIMIT, avoid broad permission grants or system-wide resets unless code-specific evidence proves a global configuration problem. Define who owns retry, cancellation, cleanup, policy changes, package repair, and user-facing messaging for CO_E_EXCEEDSYSACLLIMIT.

References

• Microsoft: IAccessControl — official Microsoft documentation relevant to CO_E_EXCEEDSYSACLLIMIT.
• Microsoft: IAccessControl::IsAccessAllowed — official Microsoft documentation relevant to CO_E_EXCEEDSYSACLLIMIT.
• Microsoft: AccessCheck — official Microsoft documentation relevant to CO_E_EXCEEDSYSACLLIMIT.
• Microsoft: LookupAccountSidW — official Microsoft documentation relevant to CO_E_EXCEEDSYSACLLIMIT.
• Microsoft: LookupAccountNameW — official Microsoft documentation relevant to CO_E_EXCEEDSYSACLLIMIT.
• Microsoft: access control lists — official Microsoft documentation relevant to CO_E_EXCEEDSYSACLLIMIT.
• Microsoft: canonical ACE order — official Microsoft documentation relevant to CO_E_EXCEEDSYSACLLIMIT.
• Microsoft: HRESULT values — official Microsoft documentation relevant to CO_E_EXCEEDSYSACLLIMIT.

---

Looking for a different code? Search another status or error code.