puppetlabs/puppet · error · Puppet::Util::Windows::Error

Failed to get security information

Error message

Failed to get security information

What it means

Raised when GetSecurityInfo returns anything other than ERROR_SUCCESS while reading owner, group, and DACL from a file handle. The handle was opened by open_file, so failure typically means the caller lacked READ_CONTROL on the object or the object type could not supply the requested information. The appended Win32 text identifies the exact cause.

Source

Thrown at lib/puppet/util/windows/security.rb:602

    sd = nil

    with_privilege(SE_BACKUP_NAME) do
      open_file(path, READ_CONTROL) do |handle|
        FFI::MemoryPointer.new(:pointer, 1) do |owner_sid_ptr_ptr|
          FFI::MemoryPointer.new(:pointer, 1) do |group_sid_ptr_ptr|
            FFI::MemoryPointer.new(:pointer, 1) do |dacl_ptr_ptr|
              FFI::MemoryPointer.new(:pointer, 1) do |sd_ptr_ptr|
                rv = GetSecurityInfo(
                  handle,
                  :SE_FILE_OBJECT,
                  OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
                  owner_sid_ptr_ptr,
                  group_sid_ptr_ptr,
                  dacl_ptr_ptr,
                  FFI::Pointer::NULL, # sacl
                  sd_ptr_ptr
                ) # sec desc
                raise Puppet::Util::Windows::Error, _("Failed to get security information") if rv != FFI::ERROR_SUCCESS

                # these 2 convenience params are not freed since they point inside sd_ptr
                owner = Puppet::Util::Windows::SID.sid_ptr_to_string(owner_sid_ptr_ptr.get_pointer(0))
                group = Puppet::Util::Windows::SID.sid_ptr_to_string(group_sid_ptr_ptr.get_pointer(0))

                FFI::MemoryPointer.new(:word, 1) do |control|
                  FFI::MemoryPointer.new(:dword, 1) do |revision|
                    sd_ptr_ptr.read_win32_local_pointer do |sd_ptr|
                      if GetSecurityDescriptorControl(sd_ptr, control, revision) == FFI::WIN32_FALSE
                        raise Puppet::Util::Windows::Error, _("Failed to get security descriptor control")
                      end

                      protect = (control.read_word & SE_DACL_PROTECTED) == SE_DACL_PROTECTED
                      dacl = parse_dacl(dacl_ptr_ptr.get_pointer(0))
                      sd = Puppet::Util::Windows::SecurityDescriptor.new(owner, group, dacl, protect)
                    end
                  end
                end

View on GitHub (pinned to e227c27540)

Solutions

1. Read the appended Win32 message / e.code (5 = access denied is most common)
2. Run elevated or grant the agent account READ_CONTROL on the target subtree (icacls <path> /grant "r")
3. Skip managing security on OS-protected paths, or take ownership first
4. Confirm the path is a filesystem object Puppet can open (not a device or pipe)

begin
  Puppet::Util::Windows::Security.get_security_descriptor(path)
rescue Puppet::Util::Windows::Error => e
  raise Puppet::Error, "Cannot read security on #{path} (code #{e.code}); elevate or grant READ_CONTROL" if e.code == 5
  raise
end

When it happens

Trigger: get_security_descriptor where the open_file handle lacks READ_CONTROL (opened with WRITE-only rights), reading security on system objects (e.g. under C:\Windows\System32) as a non-admin, or querying objects whose security information is not retrievable through the SE_FILE_OBJECT path.

Common situations: Agent running with insufficient rights over system directories; files owned by TrustedInstaller; manifests targeting OS-protected paths; handles opened on volumes/reparse points that do not support the requested information class.

Related errors

• Failed to get security descriptor control
• Failed to set security information
• Invalid DACL
• Failed to open '%{path}'
• Failed to adjust process privileges

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/53548b0a70ac887b. Report an issue: GitHub.