peass-ng/PEASS-ng · error · SecurityException

Security descriptor mismatch between specified credentials…

Error message

Security descriptor mismatch between specified credentials and credentials on existing folder by same name.

What it means

When CreateFolder fails with ERROR_ALREADY_EXISTS, the library compares the SDDL of the existing folder with the requested sddlForm; on mismatch it throws SecurityException. This prevents silently reusing a folder with different permissions than requested.

Solutions

Fetch the existing folder first and compare/update its security descriptor before creating
Call CreateFolder with exceptionOnExists:false and then explicitly SetSecurityDescriptor if needed
Align the sddlForm with the existing folder's SDDL, or delete/recreate the folder

Example fix

// before
rootFolder.CreateFolder("MyFolder", sddl); // throws if exists with different SDDL
// after
TaskFolder f;
try { f = rootFolder.CreateFolder("MyFolder", sddl); }
catch (SecurityException) {
    f = rootFolder.GetFolder("MyFolder");
    f.SetSecurityDescriptorSddlForm(sddl);
}

Defensive patterns

Strategy: try-catch

Validate before calling

// verify existing folder SDDL before creating
var existing = root.GetFolder(name);
string current = existing.GetSecurityDescriptorSddlForm();

Try / catch

try { root.CreateFolder(name, sddl); }
catch (SecurityException ex) { /* compare/update descriptor on existing folder */ }

Prevention

Check if the folder exists first and reconcile security before creating
Keep SDDL definitions consistent across deployments/tools
Use idempotent create-or-update logic rather than blind CreateFolder

When it happens

Trigger: Calling CreateFolder(name, sddlForm) where a folder with the same name already exists and its security descriptor differs from sddlForm (case-insensitive string comparison of SDDL).

Common situations: Re-running deployment/setup code with changed folder permissions; two tools creating the same folder path with different security requirements; idempotent installers with tightened SDDL.

Related errors

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/61fe025e64b7666c. Report an issue: GitHub.

Appendix: source

Thrown at winPEAS/winPEASexe/winPEAS/TaskScheduler/TaskFolder.cs:199

        public TaskFolder CreateFolder([NotNull] string subFolderName, string sddlForm = null, bool exceptionOnExists = true)
        {
            if (v2Folder == null) throw new NotV1SupportedException();
            ITaskFolder ifld = null;
            try { ifld = v2Folder.CreateFolder(subFolderName, sddlForm); }
            catch (COMException ce)
            {
                int serr = ce.ErrorCode & 0x0000FFFF;
                if (serr == 0xb7) // ERROR_ALREADY_EXISTS
                {
                    if (exceptionOnExists) throw;
                    try
                    {
                        ifld = v2Folder.GetFolder(subFolderName);
                        if (ifld != null && sddlForm != null && sddlForm.Trim().Length > 0)
                        {
                            string sd = ifld.GetSecurityDescriptor((int)Task.defaultSecurityInfosSections);
                            if (string.Compare(sddlForm, sd, StringComparison.OrdinalIgnoreCase) != 0)
                                throw new SecurityException("Security descriptor mismatch between specified credentials and credentials on existing folder by same name.");
                        }
                    }
                    catch
                    {
                        if (ifld != null)
                            Marshal.ReleaseComObject(ifld);
                        throw;
                    }
                }
                else if (serr == 0x534 || serr == 0x538 || serr == 0x539 || serr == 0x53A || serr == 0x519 || serr == 0x57)
                    throw new ArgumentException(@"Invalid SDDL form", nameof(sddlForm), ce);
                else
                    throw;
            }
            return new TaskFolder(TaskService, ifld);
        }

        /// <summary>

View on GitHub (pinned to 53fb989abc)