| Previous | Next |
| ERROR_INVALID_SECURITY_DESCR | ERROR_SERVER_DISABLED |
ERROR_BAD_INHERITANCE_ACL
Automatic security inheritance failed while building the child ACL
Inheritable ACEs on a parent are propagated according to container/object inheritance flags and are combined with explicit ACEs for the child. Windows authorization APIs support automatic propagation and creation of self-relative security descriptors for private objects. This error indicates that the inherited ACL or ACE result could not be built, rather than simply saying that the final access check denied a user.
Inspect both the parent ACL and the child/object-type context used for inheritance. Validate ACL and ACE structure, revision, sizes, inheritance flags, and any object-specific ACE information. If an application constructs security descriptors itself, compare its output with SetSecurityInfo or CreatePrivateObjectSecurity-style inheritance behavior. Replacing the DACL with a permissive one may hide the structural problem and weaken security; preserve the original descriptors and identify the malformed or incompatible inheritance input first.
What to inspect
- Validate the parent ACL and every inheritable ACE structurally.
- Record object/container inheritance flags and the child object type.
- Compare custom inheritance code with Windows automatic ACE propagation behavior.
References
- Microsoft: inheritable ACE propagation
- Microsoft: securitybaseapi functions
- MS-DTYP: SECURITY_DESCRIPTOR
Looking for a different code? Search another status or error code.