{"record":{"id":"15687aefbc0df044","repo":"puppetlabs/puppet","slug":"failed-to-get-security-descriptor-control","errorCode":null,"errorMessage":"Failed to get security descriptor control","messagePattern":"Failed to get security descriptor control","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/security.rb","lineNumber":612,"sourceCode":"                  :SE_FILE_OBJECT,\n                  OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,\n                  owner_sid_ptr_ptr,\n                  group_sid_ptr_ptr,\n                  dacl_ptr_ptr,\n                  FFI::Pointer::NULL, # sacl\n                  sd_ptr_ptr\n                ) # sec desc\n                raise Puppet::Util::Windows::Error, _(\"Failed to get security information\") if rv != FFI::ERROR_SUCCESS\n\n                # these 2 convenience params are not freed since they point inside sd_ptr\n                owner = Puppet::Util::Windows::SID.sid_ptr_to_string(owner_sid_ptr_ptr.get_pointer(0))\n                group = Puppet::Util::Windows::SID.sid_ptr_to_string(group_sid_ptr_ptr.get_pointer(0))\n\n                FFI::MemoryPointer.new(:word, 1) do |control|\n                  FFI::MemoryPointer.new(:dword, 1) do |revision|\n                    sd_ptr_ptr.read_win32_local_pointer do |sd_ptr|\n                      if GetSecurityDescriptorControl(sd_ptr, control, revision) == FFI::WIN32_FALSE\n                        raise Puppet::Util::Windows::Error, _(\"Failed to get security descriptor control\")\n                      end\n\n                      protect = (control.read_word & SE_DACL_PROTECTED) == SE_DACL_PROTECTED\n                      dacl = parse_dacl(dacl_ptr_ptr.get_pointer(0))\n                      sd = Puppet::Util::Windows::SecurityDescriptor.new(owner, group, dacl, protect)\n                    end\n                  end\n                end\n              end\n            end\n          end\n        end\n      end\n    end\n\n    sd\n  end\n","sourceCodeStart":594,"sourceCodeEnd":630,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/security.rb#L594-L630","documentation":"Raised when GetSecurityDescriptorControl returns FALSE while Puppet extracts the SE_DACL_PROTECTED flag from the security descriptor it just read. This is a defensive check on an already-retrieved descriptor; failure means the descriptor's control bits could not be read, which in practice indicates a malformed or inconsistent security descriptor. It is rare compared to the GetSecurityInfo failure above.","triggerScenarios":"get_security_descriptor on an object whose security descriptor is structurally broken (self-relative header invalid), or edge cases where the descriptor returned by GetSecurityInfo lacks readable control information.","commonSituations":"Corrupted NTFS security metadata; files restored from damaged backups; objects on third-party filesystem drivers returning non-standard descriptors.","solutions":["Reset the object's security metadata: icacls <path> /reset, or copy-recreate the file","Inspect e.code for the underlying Win32 reason before deciding","Exclude the path from ACL management if the corruption is on an expendable object","Run chkdsk on the volume if multiple objects show this failure"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"begin\n  Puppet::Util::Windows::Security.get_security_descriptor(path)\nrescue Puppet::Util::Windows::Error => e\n  raise unless e.message.include?('security descriptor control')\n  raise Puppet::Error, \"Descriptor on #{path} is corrupt; icacls '#{path}' /reset and re-apply\"\nend","preventionTips":["Treat descriptor-control read failures as corruption signals and repair with icacls /reset","Avoid managing security on objects created by unknown/non-Windows tooling without a prior icacls sanity check"],"tags":["windows","security","win32","security-descriptor","corruption"],"backgroundTag":"corrupt-security-descriptor","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}