puppetlabs/puppet · error · Puppet::Util::Windows::Error

Failed to get security descriptor control

Error message

Failed to get security descriptor control

What it means

Raised when GetSecurityDescriptorControl returns FALSE while Puppet extracts the SE_DACL_PROTECTED flag from the security descriptor it just read. This is a defensive check on an already-retrieved descriptor; failure means the descriptor's control bits could not be read, which in practice indicates a malformed or inconsistent security descriptor. It is rare compared to the GetSecurityInfo failure above.

Source

Thrown at lib/puppet/util/windows/security.rb:612

                  :SE_FILE_OBJECT,
                  OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
                  owner_sid_ptr_ptr,
                  group_sid_ptr_ptr,
                  dacl_ptr_ptr,
                  FFI::Pointer::NULL, # sacl
                  sd_ptr_ptr
                ) # sec desc
                raise Puppet::Util::Windows::Error, _("Failed to get security information") if rv != FFI::ERROR_SUCCESS

                # these 2 convenience params are not freed since they point inside sd_ptr
                owner = Puppet::Util::Windows::SID.sid_ptr_to_string(owner_sid_ptr_ptr.get_pointer(0))
                group = Puppet::Util::Windows::SID.sid_ptr_to_string(group_sid_ptr_ptr.get_pointer(0))

                FFI::MemoryPointer.new(:word, 1) do |control|
                  FFI::MemoryPointer.new(:dword, 1) do |revision|
                    sd_ptr_ptr.read_win32_local_pointer do |sd_ptr|
                      if GetSecurityDescriptorControl(sd_ptr, control, revision) == FFI::WIN32_FALSE
                        raise Puppet::Util::Windows::Error, _("Failed to get security descriptor control")
                      end

                      protect = (control.read_word & SE_DACL_PROTECTED) == SE_DACL_PROTECTED
                      dacl = parse_dacl(dacl_ptr_ptr.get_pointer(0))
                      sd = Puppet::Util::Windows::SecurityDescriptor.new(owner, group, dacl, protect)
                    end
                  end
                end
              end
            end
          end
        end
      end
    end

    sd
  end

View on GitHub (pinned to e227c27540)

Solutions

1. Reset the object's security metadata: icacls <path> /reset, or copy-recreate the file
2. Inspect e.code for the underlying Win32 reason before deciding
3. Exclude the path from ACL management if the corruption is on an expendable object
4. Run chkdsk on the volume if multiple objects show this failure

begin
  Puppet::Util::Windows::Security.get_security_descriptor(path)
rescue Puppet::Util::Windows::Error => e
  raise unless e.message.include?('security descriptor control')
  raise Puppet::Error, "Descriptor on #{path} is corrupt; icacls '#{path}' /reset and re-apply"
end

When it happens

Trigger: get_security_descriptor on an object whose security descriptor is structurally broken (self-relative header invalid), or edge cases where the descriptor returned by GetSecurityInfo lacks readable control information.

Common situations: Corrupted NTFS security metadata; files restored from damaged backups; objects on third-party filesystem drivers returning non-standard descriptors.

Related errors

• Invalid DACL
• Failed to get security information
• Failed to open '%{path}'
• Failed to adjust process privileges
• Failed to initialize ACL

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/15687aefbc0df044. Report an issue: GitHub.