peass-ng/PEASS-ng · error · SecurityException

Security descriptor mismatch between specified credentials a

Error message

Security descriptor mismatch between specified credentials and credentials on existing folder by same name.

What it means

When CreateFolder fails with ERROR_ALREADY_EXISTS, the library compares the SDDL of the existing folder with the requested sddlForm; on mismatch it throws SecurityException. This prevents silently reusing a folder with different permissions than requested.

Source

Thrown at winPEAS/winPEASexe/winPEAS/TaskScheduler/TaskFolder.cs:199

        public TaskFolder CreateFolder([NotNull] string subFolderName, string sddlForm = null, bool exceptionOnExists = true)
        {
            if (v2Folder == null) throw new NotV1SupportedException();
            ITaskFolder ifld = null;
            try { ifld = v2Folder.CreateFolder(subFolderName, sddlForm); }
            catch (COMException ce)
            {
                int serr = ce.ErrorCode & 0x0000FFFF;
                if (serr == 0xb7) // ERROR_ALREADY_EXISTS
                {
                    if (exceptionOnExists) throw;
                    try
                    {
                        ifld = v2Folder.GetFolder(subFolderName);
                        if (ifld != null && sddlForm != null && sddlForm.Trim().Length > 0)
                        {
                            string sd = ifld.GetSecurityDescriptor((int)Task.defaultSecurityInfosSections);
                            if (string.Compare(sddlForm, sd, StringComparison.OrdinalIgnoreCase) != 0)
                                throw new SecurityException("Security descriptor mismatch between specified credentials and credentials on existing folder by same name.");
                        }
                    }
                    catch
                    {
                        if (ifld != null)
                            Marshal.ReleaseComObject(ifld);
                        throw;
                    }
                }
                else if (serr == 0x534 || serr == 0x538 || serr == 0x539 || serr == 0x53A || serr == 0x519 || serr == 0x57)
                    throw new ArgumentException(@"Invalid SDDL form", nameof(sddlForm), ce);
                else
                    throw;
            }
            return new TaskFolder(TaskService, ifld);
        }

        /// <summary>

View on GitHub (pinned to 53fb989abc)

Solutions

Fetch the existing folder first and compare/update its security descriptor before creating
Call CreateFolder with exceptionOnExists:false and then explicitly SetSecurityDescriptor if needed
Align the sddlForm with the existing folder's SDDL, or delete/recreate the folder

Example fix

// before
rootFolder.CreateFolder("MyFolder", sddl); // throws if exists with different SDDL
// after
TaskFolder f;
try { f = rootFolder.CreateFolder("MyFolder", sddl); }
catch (SecurityException) {
    f = rootFolder.GetFolder("MyFolder");
    f.SetSecurityDescriptorSddlForm(sddl);
}

Defensive patterns

Strategy: try-catch

Validate before calling

// verify existing folder SDDL before creating
var existing = root.GetFolder(name);
string current = existing.GetSecurityDescriptorSddlForm();

Try / catch

try { root.CreateFolder(name, sddl); }
catch (SecurityException ex) { /* compare/update descriptor on existing folder */ }

Prevention

Check if the folder exists first and reconcile security before creating
Keep SDDL definitions consistent across deployments/tools
Use idempotent create-or-update logic rather than blind CreateFolder

When it happens

Trigger: Calling CreateFolder(name, sddlForm) where a folder with the same name already exists and its security descriptor differs from sddlForm (case-insensitive string comparison of SDDL).

Common situations: Re-running deployment/setup code with changed folder permissions; two tools creating the same folder path with different security requirements; idempotent installers with tightened SDDL.

Related errors

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/61fe025e64b7666c. Report an issue: GitHub.