| Previous | Next |
| ERROR_INVALID_OWNER | ERROR_NO_IMPERSONATION_TOKEN |
ERROR_INVALID_PRIMARY_GROUP
ERROR_INVALID_PRIMARY_GROUP (1308, 0x0000051C) means that the SID supplied as the primary group of a security descriptor cannot be assigned in this context. The primary group is security-descriptor metadata and is not the same thing as the object's owner or its access control list.
Why this field is often unnecessary
Windows access tokens contain a default primary-group SID, which may be used for security descriptors created on behalf of that token. Most application code does not need to set an object's primary group at all. Setting GROUP_SECURITY_INFORMATION unnecessarily can turn an otherwise valid ownership or ACL update into a failed operation.
How to investigate
- Leave the primary group unchanged unless the target object and protocol explicitly require a change.
- Obtain the intended value from a valid access token or a correctly resolved account or group SID rather than constructing a SID manually.
- Validate the SID before submitting it and confirm that the current security context is allowed to assign it.
- Review the
SECURITY_INFORMATIONflags so that only the owner, DACL, SACL, or group fields that need changing are passed toSetSecurityInfo.
See Microsoft documentation for access tokens and SetSecurityInfo.
Looking for a different code? Search another status or error code.