| Previous | Next |
| ERROR_INVALID_SUB_AUTHORITY | ERROR_INVALID_SID |
ERROR_INVALID_ACL
ERROR_INVALID_ACL (1336, 0x00000538) means that an access control list has an invalid binary layout. This is a data-structure error, not a normal access-denied decision.
What Windows validates
An ACL contains a revision, a total size, and a count of access control entries. IsValidAcl checks the revision and verifies that the entry count fits within the declared ACL size. A buffer that was not initialized correctly, has an incorrect length, or was overwritten can therefore produce this error.
How to prevent it
- Create new ACLs with
InitializeAcland add entries through the documented ACL APIs instead of writing the binary fields directly. - Calculate and retain the buffer size needed for the ACL, including every ACE and SID.
- Validate an externally received or deserialized ACL before attaching it to a security descriptor.
- Keep the ACL buffer alive for as long as a security descriptor refers to it.
See Microsoft documentation for IsValidAcl and access control lists.
Looking for a different code? Search another status or error code.