Knowledge

ERROR_BAD_DESCRIPTOR_FORMAT - 1361 (0x551)

A security descriptor is not in the right format (absolute or self-relative).

Updated: Feb 21, 2026

Overview

The ERROR_BAD_DESCRIPTOR_FORMAT error (1361, 0x551) indicates that a security descriptor used in the Windows operating system is not formatted correctly. This error typically arises when an application or service attempts to manipulate or access a security descriptor but encounters a format mismatch.

Technical Background

Security descriptors are crucial for managing access control and permissions on files, directories, and other objects within the Windows file system. They contain information about the owner of the object, the group that has special privileges, and the permissions granted to various users or groups.

Windows supports two types of security descriptors: absolute and self-relative. An absolute descriptor is a complete representation of all the access control entries (ACEs) for an object, while a self-relative descriptor contains only references to ACEs relative to another descriptor. The format of these descriptors must be strictly adhered to ensure proper functioning.

Error Details

The ERROR_BAD_DESCRIPTOR_FORMAT error occurs when:

  • An application or service attempts to use a security descriptor that is not in the correct format (absolute or self-relative).
  • A security descriptor is improperly formatted during creation, modification, or parsing.
  • There is an issue with the structure of the descriptor itself, such as incorrect data types or missing fields.

Common Causes

Common causes for this error include:

  • Invalid parameter values passed to functions that manipulate security descriptors.
  • Incorrect object type being used in operations involving security descriptors.
  • Exceeding limits on the number or size of ACEs within a descriptor.
  • Corrupted data within the descriptor, leading to an incorrect format.

Real-World Context

This error can occur in various scenarios, such as:

  • When attempting to modify permissions on a file or directory using the SetSecurityInfo function.
  • During the creation of security descriptors for new objects.
  • In situations where existing security descriptors are being parsed or validated by an application.

Is This Error Critical?

The criticality of this error depends on its context. If it occurs during a critical operation, such as modifying permissions on a system file, it could have significant implications. However, in non-critical operations, the impact may be minimal.

How to Diagnose

To diagnose and resolve ERROR_BAD_DESCRIPTOR_FORMAT, follow these steps:

  1. Review Operation Context: Ensure that the operation being performed is appropriate for the object type (file, directory, etc.).
  2. Validate Parameters: Check the parameters passed to functions related to security descriptors, such as SetSecurityInfo or GetNamedSecurityInfo. Ensure they are correctly formatted and contain valid data.
  3. Confirm Object Types: Verify that the correct object types are being used in operations involving security descriptors. For example, ensure that a file descriptor is not mistakenly treated as a directory descriptor.
  4. Verify Input Data: Inspect any input data or descriptors to ensure they are correctly formatted and do not contain corrupted information.
  5. Check Limits or Constraints: Ensure that the number of ACEs within a descriptor does not exceed system limits, which can vary based on the version of Windows.

How to Resolve

To resolve ERROR_BAD_DESCRIPTOR_FORMAT, consider the following steps:

  • Correct any invalid parameter values and ensure they are correctly formatted.
  • Adjust the operation context if necessary, ensuring that it is appropriate for the object type being manipulated.
  • Restore or correct corrupted data within security descriptors.
  • Retry operations with valid inputs to see if the error persists.

Developer Notes

Developers should be cautious when working with security descriptors and ensure that all parameters are correctly formatted. Proper validation of input data can prevent this error from occurring. Additionally, understanding the differences between absolute and self-relative descriptors is crucial for correct usage.

Related Errors

FAQ

Q: What does the ERROR_BAD_DESCRIPTOR_FORMAT error mean?

A: It indicates that a security descriptor used in an operation is not formatted correctly, either as an absolute or self-relative descriptor.

Q: How can I prevent this error from occurring?

A: Ensure all parameters passed to functions involving security descriptors are correctly formatted and validated. Understand the differences between absolute and self-relative descriptors.

Q: Can this error occur in any version of Windows?

A: Yes, it can occur across different versions of Windows, but the specific behavior and limits may vary.

Summary

The ERROR_BAD_DESCRIPTOR_FORMAT error (1361, 0x551) is a critical indication that a security descriptor used in an operation is not correctly formatted. Developers should ensure proper validation and formatting of parameters when working with security descriptors to avoid this issue.