Query regarding Error code : 87 - The Parameter is Incorrect

Paramesh T S 1

Hi, Recently I have faced an Error code 87 in two different instances.

Instance 1 :
I was trying to apply SACL of a folder named "Test_Folder" using Cacls.exe, It returned the error : 87 , Then I found that the folder is having 1820 DACL's and after referring this document : https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/error-add-user-to-security-permissions confimed that why this error came.

Instance 2 :
I have written a CPP file to set SACL for an share/folder say "temp_folder" using Win API (https://learn.microsoft.com/en-us/windows/win32/api/aclapi/nf-aclapi-setentriesinacla)) , the "temp folder" doesnot have more than 10 ACLs and 0 SACLs before applying, I have tried to apply the SACL using that CPP file it didn't work and returns error 87 , but for other shares/folder it works well and SACL applied without any error and the parameters inserted are correct as I checked. In this instance I cannot able to find where the actual issue is.

By referring the above two instances , It returns only the Error code 87 if error encountered, But the error does not say where and why the actual error is coming , Kindly someone guide me how to analyse the error parameter is incorrect.

Jeanine Zhang-MSFT 10,436 Reputation points Microsoft Vendor

2023-01-19T01:40:01.5866667+00:00

According to the Doc: System Error Codes (0-499)

The SetEntriesInAclA function returns the Error code 87:ERROR_INVALID_PARAMETER 87 (0x57) The parameter is incorrect.

Could you please provide the sample to help us reproduce the issue?
Paramesh T S 1 Reputation point

2023-01-23T06:24:07.4333333+00:00

@Jeanine Zhang-MSFT , It is more of Environmental specific issue but Why Windows just says only the error code 87 without stating where the actual issue is and how to analyze the issue with just only the code or statement "The parameter is incorrect"

1 answer

MotoX80 35,136 Reputation points

2023-01-19T00:52:22.1066667+00:00

Instance 1 :
Don't put 1820 DACL's on the file system. Use groups instead of individual accounts. How many of them are dead SID's from deleted accounts?

Instance 2 :

Sounds like you have a bug in your program. Are you trying to also add individual user's accounts to the audit policy? If so, why don't you just use the Windows explorer and add "everyone" or "authenticated users" instead?
Please sign in to rate this answer.

1 person found this answer helpful.
RLWA32 46,461 Reputation points

2023-01-19T02:38:17.3766667+00:00

The linked documentation speaks to the maximums for an ACL ("64 kilobytes (KB), or approximately 1,820 ACEs"). This would imply that the limitation would apply individually to the DACL and the SACL. So if the user was trying to add entries to the SACL, would the size of the DACL be relevant?

Paramesh T S 1 Reputation point

2023-01-19T08:23:32.1533333+00:00

I just tried some ways to apply SACL , At that time I faced that issue, But my actual question is Why Windows just says only the error code 87 without stating where the actual issue is and how to analyze the issue with just only the code or statement "The parameter is incorrect"

MotoX80 35,136 Reputation points

2023-01-19T13:44:02.8666667+00:00

I share your frustration. with error messages. I'll speculate that maybe the original developer was trying to meet his deadline, or the program specs that he was given didn't call for expanded error details, or the specs called for the code to be as small as possible or maybe this is just a catch all error for "I don't know what you are asking me to do".

RLWA32 46,461 Reputation points

2023-01-19T13:58:11.7266667+00:00

Raymond Chen's blog had an interesting take on error codes https://devblogs.microsoft.com/oldnewthing/20220119-00/?p=106176
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Query regarding Error code : 87 - The Parameter is Incorrect

1 answer

Your answer