| Previous | Next |
| CO_E_FAILEDTOCLOSEHANDLE | CO_E_ACESINWRONGORDER |
CO_E_EXCEEDSYSACLLIMIT
ACL contains more ACEs than the system supports
CO_E_EXCEEDSYSACLLIMIT is HRESULT 2147549497 (0x80010139) from winerror.h. The documented description is “The number of ACEs in an ACL exceeds the system limit.” The relevant context is the COM IAccessControl, DCOM client identity, trustee translation, token inspection, security descriptor, ACL, or serialization workflow.
Where it is encountered
- IAccessControl initialization, access checks, owner/trustee processing, and serialized ACL persistence.
- Server-side DCOM impersonation, client blanket inspection, token and SID lookup.
- Security descriptor construction, DACL canonicalization, file-backed policy storage, or legacy NetAccess migration.
The immediate focus is a generated access-control list whose entry count or total size exceeds platform or consuming implementation limits.
What to verify
Verify that duplicate, inherited, redundant, and obsolete ACEs are identified before any permissions are removed. That condition determines whether the same object can continue, a new object is required, or policy must change.
Difference from nearby HRESULTs
It is capacity exhaustion; CO_E_ACESINWRONGORDER concerns canonical ordering of an otherwise representable ACL.
Correct handling and recovery
Canonicalize and consolidate equivalent entries, use group-based authorization, and redesign overly granular policy. Preserve effective-access tests during compaction.
Reconcile partial output and server-side effects before attempting the operation again.
Practical scenario
A deployment adds one ACE per user until the DACL exceeds limits. Administration creates a security group and replaces thousands of user ACEs with one group ACE.
References
Looking for a different code? Search another status or error code.