What does Windows error code 1338 (ERROR_INVALID_SECURITY_DESCR) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The security descriptor structure is invalid.

Previous	Next
ERROR_INVALID_SID	ERROR_BAD_INHERITANCE_ACL

ERROR_INVALID_SECURITY_DESCR

ERROR_INVALID_SECURITY_DESCR (1338, 0x0000053A) means that a security descriptor or one of its supplied components is structurally invalid. It should be investigated as malformed security data, not as an ordinary permissions failure.

Validate at more than one level

IsValidSecurityDescriptor checks the components that are present in a security descriptor, but it does not validate the contents of individual ACLs or ACEs. A descriptor can therefore require separate validation of its DACL or SACL with IsValidAcl, and of any supplied SID with IsValidSid.

Common construction mistakes

Passing an uninitialized SECURITY_DESCRIPTOR instead of starting with InitializeSecurityDescriptor.
Confusing an absolute descriptor with a self-relative descriptor when storing or transporting security data.
Using a NULL DACL unintentionally. A NULL DACL grants full access and is different from an empty DACL, which grants no access.
Letting the memory backing an ACL, SID, or descriptor expire before the API consuming it has completed.

See Microsoft documentation for IsValidSecurityDescriptor, InitializeSecurityDescriptor, and DACL handling.

Looking for a different code? Search another status or error code.