| Previous | Next |
| STATUS_INVALID_LOCK_RANGE | STATUS_IMAGE_SUBSYSTEM_NOT_PRESENT |
STATUS_INVALID_ACE_CONDITION
The dynamic access-control expression is malformed
Conditional ACEs encode an expression in the application data of a callback ACE. The bytecode has defined token types, operand rules, and alignment requirements. This status means the expression is structurally invalid, not merely that its predicates evaluated to false for the current user or resource.
Round-tripping a security descriptor through an incomplete SDDL parser can damage conditions. Preserve the original descriptor, identify the exact ACE, and regenerate it with an API or policy editor that supports the required conditional syntax and operating-system version.
What to inspect
- Decode the self-relative security descriptor and isolate the failing callback ACE.
- Compare its binary application data with the documented conditional-expression representation.
- Check whether the expression uses operators unsupported by the target Windows release.
References
- Microsoft Open Specifications: conditional ACE representation
- Microsoft Open Specifications: SDDL and ACE syntax
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.