{"record":{"id":"61fe025e64b7666c","repo":"peass-ng/PEASS-ng","slug":"security-descriptor-mismatch-between-specified-cre","errorCode":null,"errorMessage":"Security descriptor mismatch between specified credentials and credentials on existing folder by same name.","messagePattern":"Security descriptor mismatch between specified credentials and credentials on existing folder by same name\\.","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/TaskScheduler/TaskFolder.cs","lineNumber":199,"sourceCode":"        public TaskFolder CreateFolder([NotNull] string subFolderName, string sddlForm = null, bool exceptionOnExists = true)\n        {\n            if (v2Folder == null) throw new NotV1SupportedException();\n            ITaskFolder ifld = null;\n            try { ifld = v2Folder.CreateFolder(subFolderName, sddlForm); }\n            catch (COMException ce)\n            {\n                int serr = ce.ErrorCode & 0x0000FFFF;\n                if (serr == 0xb7) // ERROR_ALREADY_EXISTS\n                {\n                    if (exceptionOnExists) throw;\n                    try\n                    {\n                        ifld = v2Folder.GetFolder(subFolderName);\n                        if (ifld != null && sddlForm != null && sddlForm.Trim().Length > 0)\n                        {\n                            string sd = ifld.GetSecurityDescriptor((int)Task.defaultSecurityInfosSections);\n                            if (string.Compare(sddlForm, sd, StringComparison.OrdinalIgnoreCase) != 0)\n                                throw new SecurityException(\"Security descriptor mismatch between specified credentials and credentials on existing folder by same name.\");\n                        }\n                    }\n                    catch\n                    {\n                        if (ifld != null)\n                            Marshal.ReleaseComObject(ifld);\n                        throw;\n                    }\n                }\n                else if (serr == 0x534 || serr == 0x538 || serr == 0x539 || serr == 0x53A || serr == 0x519 || serr == 0x57)\n                    throw new ArgumentException(@\"Invalid SDDL form\", nameof(sddlForm), ce);\n                else\n                    throw;\n            }\n            return new TaskFolder(TaskService, ifld);\n        }\n\n        /// <summary>","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/TaskScheduler/TaskFolder.cs#L181-L217","documentation":"When CreateFolder fails with ERROR_ALREADY_EXISTS, the library compares the SDDL of the existing folder with the requested sddlForm; on mismatch it throws SecurityException. This prevents silently reusing a folder with different permissions than requested.","triggerScenarios":"Calling CreateFolder(name, sddlForm) where a folder with the same name already exists and its security descriptor differs from sddlForm (case-insensitive string comparison of SDDL).","commonSituations":"Re-running deployment/setup code with changed folder permissions; two tools creating the same folder path with different security requirements; idempotent installers with tightened SDDL.","solutions":["Fetch the existing folder first and compare/update its security descriptor before creating","Call CreateFolder with exceptionOnExists:false and then explicitly SetSecurityDescriptor if needed","Align the sddlForm with the existing folder's SDDL, or delete/recreate the folder"],"exampleFix":"// before\nrootFolder.CreateFolder(\"MyFolder\", sddl); // throws if exists with different SDDL\n// after\nTaskFolder f;\ntry { f = rootFolder.CreateFolder(\"MyFolder\", sddl); }\ncatch (SecurityException) {\n    f = rootFolder.GetFolder(\"MyFolder\");\n    f.SetSecurityDescriptorSddlForm(sddl);\n}","handlingStrategy":"try-catch","validationCode":"// verify existing folder SDDL before creating\nvar existing = root.GetFolder(name);\nstring current = existing.GetSecurityDescriptorSddlForm();","typeGuard":null,"tryCatchPattern":"try { root.CreateFolder(name, sddl); }\ncatch (SecurityException ex) { /* compare/update descriptor on existing folder */ }","preventionTips":["Check if the folder exists first and reconcile security before creating","Keep SDDL definitions consistent across deployments/tools","Use idempotent create-or-update logic rather than blind CreateFolder"],"tags":["security","sddl","taskscheduler","folders","conflict"],"backgroundTag":"security-descriptor-mismatch","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}