peass-ng/PEASS-ng · error · ArgumentException

Invalid SDDL form

Error message

Invalid SDDL form

What it means

CreateFolder maps specific COMException HRESULT low-words (0x534, 0x538, 0x539, 0x53A, 0x519, 0x57 — SDDL/ACL parse errors) to an ArgumentException('Invalid SDDL form') wrapping the original COM exception. The underlying COM API rejected the security descriptor string as malformed.

Source

Thrown at winPEAS/winPEASexe/winPEAS/TaskScheduler/TaskFolder.cs:210

                    try
                    {
                        ifld = v2Folder.GetFolder(subFolderName);
                        if (ifld != null && sddlForm != null && sddlForm.Trim().Length > 0)
                        {
                            string sd = ifld.GetSecurityDescriptor((int)Task.defaultSecurityInfosSections);
                            if (string.Compare(sddlForm, sd, StringComparison.OrdinalIgnoreCase) != 0)
                                throw new SecurityException("Security descriptor mismatch between specified credentials and credentials on existing folder by same name.");
                        }
                    }
                    catch
                    {
                        if (ifld != null)
                            Marshal.ReleaseComObject(ifld);
                        throw;
                    }
                }
                else if (serr == 0x534 || serr == 0x538 || serr == 0x539 || serr == 0x53A || serr == 0x519 || serr == 0x57)
                    throw new ArgumentException(@"Invalid SDDL form", nameof(sddlForm), ce);
                else
                    throw;
            }
            return new TaskFolder(TaskService, ifld);
        }

        /// <summary>
        /// Deletes a subfolder from the parent folder. Not available to Task Scheduler 1.0.
        /// </summary>
        /// <param name="subFolderName">The name of the subfolder to be removed. The root task folder is specified with a backslash (\). This parameter can be a relative path to the folder you want to delete. An example of a task folder path, under the root task folder, is \MyTaskFolder. The '.' character cannot be used to specify the current task folder and the '..' characters cannot be used to specify the parent task folder in the path.</param>
        /// <param name="exceptionOnNotExists">Set this value to false to avoid having an exception called if the folder does not exist.</param>
        /// <exception cref="Microsoft.Win32.TaskScheduler.NotV1SupportedException">Not supported under Task Scheduler 1.0.</exception>
        public void DeleteFolder([NotNull] string subFolderName, bool exceptionOnNotExists = true)
        {
            if (v2Folder != null)
            {
                try
                {

View on GitHub (pinned to 53fb989abc)

Solutions

1. Validate the SDDL string, e.g. via new TaskSecurity().SetSecurityDescriptorSddlForm(sddl) or a RawSecurityDescriptor parse, before calling CreateFolder
2. Build SDDL from known constant SID strings (BA, SY, BU, etc.) and correct ACE order
3. Inspect the inner COMException for the exact HRESULT to pinpoint the parse error

Example fix

// before
rootFolder.CreateFolder("MyFolder", "O:BAG:DUD:(A;;GRGX;;;BAD-SID");
// after
var validated = "O:BAG:DUD:(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)";
rootFolder.CreateFolder("MyFolder", validated);

try { var _ = new System.Security.AccessControl.RawSecurityDescriptor(sddlForm); } catch (Exception e) { throw new ArgumentException("Invalid SDDL", nameof(sddlForm), e); }

try { root.CreateFolder(name, sddl); }
catch (ArgumentException ex) when (ex.Message.Contains("SDDL")) { /* fix descriptor string */ }

When it happens

Trigger: Calling CreateFolder(name, sddlForm) with a syntactically invalid SDDL string — bad ACE format, unknown SID, missing permissions field — causing the COM call to fail with one of the mapped error codes.

Common situations: Hand-built SDDL strings with typos; copying SDDL from documentation with unsupported SIDs; interpolating user/account names directly into SDDL instead of translating to SID form.

Related errors

• The array and none of the values passed as parameters may be
• Value cannot be null. (Parameter 'folderSecurity')
• Security descriptor mismatch between specified credentials a
• A task must be registered with at least one action and no mo
• Function '{func}' in module {path} is imported from itself

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/3f788b2b8764ff86. Report an issue: GitHub.