What does Windows error code 804 (ERROR_NO_ACE_CONDITION) mean?

ERROR_NO_ACE_CONDITION

the specified access-control entry does not contain a condition.

ERROR_NO_ACE_CONDITION indicates this condition: Conditional ACE APIs expect a callback or resource-attribute expression embedded in the access-control entry. This result means the caller asked to read, evaluate, or modify a condition on an ACE type that has none.

Where the result appears

• GetAce or security-descriptor tooling inspecting conditional ACEs.
• central access policy and dynamic access control utilities.
• administrative code converting SDDL to structured ACL data.
• authorization diagnostics that assume every callback ACE contains a condition.

What to collect

• the ACE type, flags, size, SID, and raw bytes.
• the source SDDL and the parsed security descriptor.
• which API expected a condition and why.
• whether the ACL was canonicalized or transformed before inspection.

Handling and recovery

Check the ACE type before requesting its condition. Treat absence as a valid structural case when the contract allows ordinary, unconditional ACEs; only report corruption when the surrounding descriptor violates its documented format.

Common misinterpretation

An ACE without a condition is not automatically invalid. Many common allow and deny ACEs are intentionally unconditional.

References

• Microsoft: System error codes 500–999