SetNamedSecurityInfo Error code -87

Question

SetNamedSecurityInfo Error code -87

Naveen S 0

Hi, We have been facing this issue since Jan 2023.

Code Snippet:

LPWSTR shareName = (LPWSTR)L"//TEST/test";	
DWORD dwRes = SetNamedSecurityInfo(shareName, SE_FILE_OBJECT, SACL_SECURITY_INFORMATION, NULL, NULL, NULL, NULL);	if (ERROR_SUCCESS != dwRes) {		
	cout << "Error while setting SACL in SetNamedSecurityInfo Error  " << dwRes << endl;		
	return -1;	
}

Here, we are passing only the shareName as a parameter and all the remaining parameters are constant.

Normally this code should function without setting any SACL permissions and without any errors.

But, this is throwing an error 87, which means "The parameter is incorrect". But the only parameter that has been passed is the shareName and if the shareName is wrong, then the function should throw an error 67 which means "The network name cannot be found".

Why error 87 is thrown in this case?

Help me fix this issue ASAP.

Viorel 122.5K Reputation points

2023-07-17T14:49:41.2333333+00:00

Maybe you should not pass a fake LPWSTR parameter.
Naveen S 0 Reputation points

2023-07-17T14:53:04.37+00:00

If the shareName is wrong, it must have thrown an error 67 which means "The network name cannot be found".
Naveen S 0 Reputation points

2023-07-17T14:58:32.54+00:00

And for your concern, the given shareName is the valid network path.
Viorel 122.5K Reputation points

2023-07-17T15:00:29.1766667+00:00

Maybe the shareName is correct, but is not a real LPWSTR.
Naveen S 0 Reputation points

2023-07-17T15:02:36.7733333+00:00

How to cross-check this condition?
RLWA32 49,536 Reputation points

2023-07-17T17:05:13.1733333+00:00

Have you tried using backslashes in the object name? They are what is specified in the documentation for the name string to be passed for SE_FILE_OBJECT. https://learn.microsoft.com/en-us/windows/win32/api/accctrl/ne-accctrl-se_object_type
Naveen S 0 Reputation points

2023-07-17T18:26:01.1+00:00

Yes tried using both the slashes but still the same issue.
David Lowndes 2,640 Reputation points MVP

2023-07-17T22:15:35.38+00:00

What happens if you change your string to be:
L"\\\\TEST\\test"
... and ensure you run your program as administrator.
Naveen S 0 Reputation points

2023-07-19T08:11:02.6433333+00:00

I tried already, the same error occurs.

1 answer

Your answer

Viorel 122.5K Reputation points

2023-07-17T14:49:41.2333333+00:00

Maybe you should not pass a fake LPWSTR parameter.
Naveen S 0 Reputation points

2023-07-17T14:53:04.37+00:00

If the shareName is wrong, it must have thrown an error 67 which means "The network name cannot be found".
Naveen S 0 Reputation points

2023-07-17T14:58:32.54+00:00

And for your concern, the given shareName is the valid network path.
Viorel 122.5K Reputation points

2023-07-17T15:00:29.1766667+00:00

Maybe the shareName is correct, but is not a real LPWSTR.
Naveen S 0 Reputation points

2023-07-17T15:02:36.7733333+00:00

How to cross-check this condition?
RLWA32 49,536 Reputation points

2023-07-17T17:05:13.1733333+00:00

Have you tried using backslashes in the object name? They are what is specified in the documentation for the name string to be passed for SE_FILE_OBJECT. https://learn.microsoft.com/en-us/windows/win32/api/accctrl/ne-accctrl-se_object_type
Naveen S 0 Reputation points

2023-07-17T18:26:01.1+00:00

Yes tried using both the slashes but still the same issue.
David Lowndes 2,640 Reputation points MVP

2023-07-17T22:15:35.38+00:00

What happens if you change your string to be:
L"\\\\TEST\\test"
... and ensure you run your program as administrator.
Naveen S 0 Reputation points

2023-07-19T08:11:02.6433333+00:00

I tried already, the same error occurs.

Answer 1

Jeanine Zhang-MSFT 11,356 Microsoft External Staff

Hello,

Welcome to Microsoft Q&A!

According to the Doc: SetNamedSecurityInfoA function

If setting SACL_SECURITY_INFORMATION or SCOPE_SECURITY_INFORMATION, the caller must have the SE_SECURITY_NAME privilege enabled. If you are not setting the SACL, this parameter can be NULL.

According to your code, you set the SACL_SECURITY_INFORMATION flag, but you set the pSacl to NULL. As far as I'm concerned, it is the reason for the error. When you use the SACL_SECURITY_INFORMATION flag, you must have the SE_SECURITY_NAME privilege enabled, the pSacl should point to the SACL for the object.

Thank you.

Jeanine

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

RLWA32 49,536 Reputation points

2023-07-18T06:51:31.9066667+00:00

However, it is interesting to note that SetSecurityDescriptorSacl accepts a NULL SACL pointer parameter. "If this parameter is NULL, a NULL SACL is assigned to the security descriptor."
Naveen S 0 Reputation points

2023-07-18T14:35:00.5933333+00:00

I tried with another pc, there it worked fine without issue even when SACL pointer is NULL(pacl)

Code snippet:

c
RLWA32 49,536 Reputation points

2023-07-18T16:40:32.04+00:00

I tried with another pc, there it worked fine without issue even when SACL pointer is NULL(pacl)

Well, that would indicate that the problem is not coding but environmental. So the next question is what is different between the machines and software installed where the code is successful and where it fails? Different versions of windows? Different security software? And so forth.

Naveen S 0

SACL_with_PACL.exe has pACL entries set in it. When I try to set SACL using this exe, it throws the same error 87.
Even without pACL, (i.e., with pACL parameter as nullptr) it is throwing the same error 87.
But I tried these applications in other pcs there it worked fine and SACL was set successfully.
What may be the reason causing this issue?

Naveen S 0 Reputation points

2023-07-24T17:46:38.5366667+00:00
RLWA32 49,536 Reputation points

2023-07-25T15:31:22.51+00:00

@Naveen S The two comments above don't add any new information.

Have you identified any significant differences between the systems where the code succeeds and where it fails?

Share via

SetNamedSecurityInfo Error code -87

1 answer

Your answer