{"record":{"id":"3f788b2b8764ff86","repo":"peass-ng/PEASS-ng","slug":"invalid-sddl-form","errorCode":null,"errorMessage":"Invalid SDDL form","messagePattern":"Invalid SDDL form","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/TaskScheduler/TaskFolder.cs","lineNumber":210,"sourceCode":"                    try\n                    {\n                        ifld = v2Folder.GetFolder(subFolderName);\n                        if (ifld != null && sddlForm != null && sddlForm.Trim().Length > 0)\n                        {\n                            string sd = ifld.GetSecurityDescriptor((int)Task.defaultSecurityInfosSections);\n                            if (string.Compare(sddlForm, sd, StringComparison.OrdinalIgnoreCase) != 0)\n                                throw new SecurityException(\"Security descriptor mismatch between specified credentials and credentials on existing folder by same name.\");\n                        }\n                    }\n                    catch\n                    {\n                        if (ifld != null)\n                            Marshal.ReleaseComObject(ifld);\n                        throw;\n                    }\n                }\n                else if (serr == 0x534 || serr == 0x538 || serr == 0x539 || serr == 0x53A || serr == 0x519 || serr == 0x57)\n                    throw new ArgumentException(@\"Invalid SDDL form\", nameof(sddlForm), ce);\n                else\n                    throw;\n            }\n            return new TaskFolder(TaskService, ifld);\n        }\n\n        /// <summary>\n        /// Deletes a subfolder from the parent folder. Not available to Task Scheduler 1.0.\n        /// </summary>\n        /// <param name=\"subFolderName\">The name of the subfolder to be removed. The root task folder is specified with a backslash (\\). This parameter can be a relative path to the folder you want to delete. An example of a task folder path, under the root task folder, is \\MyTaskFolder. The '.' character cannot be used to specify the current task folder and the '..' characters cannot be used to specify the parent task folder in the path.</param>\n        /// <param name=\"exceptionOnNotExists\">Set this value to false to avoid having an exception called if the folder does not exist.</param>\n        /// <exception cref=\"Microsoft.Win32.TaskScheduler.NotV1SupportedException\">Not supported under Task Scheduler 1.0.</exception>\n        public void DeleteFolder([NotNull] string subFolderName, bool exceptionOnNotExists = true)\n        {\n            if (v2Folder != null)\n            {\n                try\n                {","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/TaskScheduler/TaskFolder.cs#L192-L228","documentation":"CreateFolder maps specific COMException HRESULT low-words (0x534, 0x538, 0x539, 0x53A, 0x519, 0x57 — SDDL/ACL parse errors) to an ArgumentException('Invalid SDDL form') wrapping the original COM exception. The underlying COM API rejected the security descriptor string as malformed.","triggerScenarios":"Calling CreateFolder(name, sddlForm) with a syntactically invalid SDDL string — bad ACE format, unknown SID, missing permissions field — causing the COM call to fail with one of the mapped error codes.","commonSituations":"Hand-built SDDL strings with typos; copying SDDL from documentation with unsupported SIDs; interpolating user/account names directly into SDDL instead of translating to SID form.","solutions":["Validate the SDDL string, e.g. via new TaskSecurity().SetSecurityDescriptorSddlForm(sddl) or a RawSecurityDescriptor parse, before calling CreateFolder","Build SDDL from known constant SID strings (BA, SY, BU, etc.) and correct ACE order","Inspect the inner COMException for the exact HRESULT to pinpoint the parse error"],"exampleFix":"// before\nrootFolder.CreateFolder(\"MyFolder\", \"O:BAG:DUD:(A;;GRGX;;;BAD-SID\");\n// after\nvar validated = \"O:BAG:DUD:(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)\";\nrootFolder.CreateFolder(\"MyFolder\", validated);","handlingStrategy":"validation","validationCode":"try { var _ = new System.Security.AccessControl.RawSecurityDescriptor(sddlForm); } catch (Exception e) { throw new ArgumentException(\"Invalid SDDL\", nameof(sddlForm), e); }","typeGuard":null,"tryCatchPattern":"try { root.CreateFolder(name, sddl); }\ncatch (ArgumentException ex) when (ex.Message.Contains(\"SDDL\")) { /* fix descriptor string */ }","preventionTips":["Validate SDDL strings by parsing them before use","Use well-known SID constants (BA, SY, BU) rather than hand-built SIDs","Keep canonical SDDL templates in one place; copy from working examples"],"tags":["sddl","argumentexception","taskscheduler","validation"],"backgroundTag":"invalid-sddl","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}