{"record":{"id":"1a17685be3020acd","repo":"puppetlabs/puppet","slug":"failed-to-add-access-control-entry","errorCode":null,"errorMessage":"Failed to add access control entry","messagePattern":"Failed to add access control entry","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/security.rb","lineNumber":440,"sourceCode":"\n    new_sd = Puppet::Util::Windows::SecurityDescriptor.new(sd.owner, sd.group, dacl, protected)\n    set_security_descriptor(path, new_sd)\n\n    nil\n  end\n\n  ACL_REVISION = 2\n\n  def add_access_allowed_ace(acl, mask, sid, inherit = nil)\n    inherit ||= NO_INHERITANCE\n\n    Puppet::Util::Windows::SID.string_to_sid_ptr(sid) do |sid_ptr|\n      if Puppet::Util::Windows::SID.IsValidSid(sid_ptr) == FFI::WIN32_FALSE\n        raise Puppet::Util::Windows::Error, _(\"Invalid SID\")\n      end\n\n      if AddAccessAllowedAceEx(acl, ACL_REVISION, inherit, mask, sid_ptr) == FFI::WIN32_FALSE\n        raise Puppet::Util::Windows::Error, _(\"Failed to add access control entry\")\n      end\n    end\n\n    # ensure this method is void if it doesn't raise\n    nil\n  end\n\n  def add_access_denied_ace(acl, mask, sid, inherit = nil)\n    inherit ||= NO_INHERITANCE\n\n    Puppet::Util::Windows::SID.string_to_sid_ptr(sid) do |sid_ptr|\n      if Puppet::Util::Windows::SID.IsValidSid(sid_ptr) == FFI::WIN32_FALSE\n        raise Puppet::Util::Windows::Error, _(\"Invalid SID\")\n      end\n\n      if AddAccessDeniedAceEx(acl, ACL_REVISION, inherit, mask, sid_ptr) == FFI::WIN32_FALSE\n        raise Puppet::Util::Windows::Error, _(\"Failed to add access control entry\")\n      end","sourceCodeStart":422,"sourceCodeEnd":458,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/security.rb#L422-L458","documentation":"Raised when AddAccessAllowedAceEx returns FALSE inside Security.add_access_allowed_ace (lib/puppet/util/windows/security.rb:440). The SID has already passed IsValidSid at this point, so the failure is about the ACL itself: ERROR_ALLOTTED_SPACE_EXCEEDED (1344) when the ACL buffer has no room for another ACE (too many entries), ERROR_INVALID_PARAMETER (87) for inherit-flag combinations invalid at the pinned ACL_REVISION = 2, or ERROR_INVALID_ACL for a malformed or uninitialized ACL.","triggerScenarios":"Appending more ACEs than the ACL buffer was sized for (large permission lists); using object-inheritance flags that need ACL_REVISION_DS (3+) while the code pins revision 2; inherit flags not valid for the object type (files vs directories vs registry keys); an acl pointer that was not built by InitializeAcl.","commonSituations":"ACL resources granting many individual accounts on one object instead of groups; deep inheritance sets on directory trees and registry keys; DACLs approaching size limits after successive additions.","solutions":["Reduce the ACE count: grant a domain/local group and manage membership instead of enumerating accounts.","Use inherit flags valid for the object type (CONTAINER_INHERIT_ACE|OBJECT_INHERIT_ACE for directories; none for plain files).","Avoid object-type ACEs with this helper — it pins ACL_REVISION = 2, which cannot hold them.","Rescue Puppet::Util::Windows::Error and log e.code to identify the limit hit (1344 buffer full vs 87 invalid parameter)."],"exampleFix":"# before — one ACE per user, ACL fills up\nusers.each { |u| add_access_allowed_ace(acl, mask, sid_for(u)) }\n\n# after — one group, one ACE, inheritance flags set once\nsid = Puppet::Util::Windows::SID.name_to_principal('DOMAIN\\AppUsers')&.sid\ninherit = 0x3 # CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE\nadd_access_allowed_ace(acl, mask, sid, inherit) if sid","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"begin\n  add_access_allowed_ace(acl, mask, sid, inherit)\nrescue Puppet::Util::Windows::Error => e\n  Puppet.err \"AddAccessAllowedAceEx failed (#{e.code}) for SID #{sid}\"\n  raise if e.code != 1344 # ERROR_ALLOTTED_SPACE_EXCEEDED\n  # ACL full — collapse entries into a group and retry once\nend","preventionTips":["Grant groups, not individual users, to keep ACE counts low","Size the ACL buffer for all planned ACEs before adding any","Use object-type-appropriate inheritance flags","Watch DACL size limits (about 64K) when managing large permission sets"],"tags":["windows","acl","ace","security","win32-api","puppet"],"backgroundTag":"win32-add-ace-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}