Secure Copy - 'The security ID structure is invalid' error when copying data (4318566)

Secure Copy - 'The security ID structure is invalid' error when copying data

Secure Copy - 'The security ID structure is invalid' error when copying data

This error is generated when an attempt to read or write security descriptor information fails because an invalid security identifier (SID) was encountered in the security descriptor information.

Alternate Error
"This security ID may not be assigned as the owner of this object."
This error is generated when the security descriptor's ownership information is invalid.

This error is uncommon and has been reported only in those cases where a non-Windows powered Network Attached Storage (NAS) system is included as either a source or destination system.

When Secure Copy copies a file the security descriptor information contained within the file is also copied.

Note: Use of the term 'file' applies to folders as well, since Windows simply treats folders as a special type of file.

A security descriptor includes four components:

 

• The SID that identifies the object's owner

   

• The SID that identifies the object's primary group

   

• The discretionary access control list (DACL) that is controlled by the owner of the file and specifies the access that users or groups have to the file

   

• The system access control list (SACL) that controls the generation of audit messages for attempts to access an file

   

The DACL and SACL components always exist in a security descriptor, but do not necessarily contain information.

 

• If a file does not have a DACL defined, the system allows everyone full access to it.

   

• If a file has a DACL, the system allows only the access that is explicitly allowed by the access control entries (ACEs) in the DACL.

   

• If there are no ACEs in the DACL, the system does not allow access to anyone.

   

SACL entries follow these same guidelines, and inheritance flags are also contained within the DACL and SACL components.

 

 

 

Current Working Theory

 

• Secure Copy executes a job using the context of the user's account.

   

• The NAS device is configured to modify the ownership information to reflect its local Administrative account.

   

• The original owner's information has been changed and/or the security descriptor contains a SID that cannot be translated.

   

Solution:

 

Secure Copy is simply reporting the response it received from the NAS device when it attempted to read or write the security descriptor information, so there is no workaround that can be implemented using Secure Copy to eliminate occurances of the error.

 

 

 

However, since data is copied successfully, Security Explorer can be used to modify ownership and DACL information once the data migration is finished.

 

 

 

- Resolution for a NASUNI NAS - Case 4299339 - The account in the target domain that I am using to run the Secure Copy application was added into the "administrative users" group in the NASUNI filer configuration according to the administrator of the NAS. - Resolution for Netapp file share (FAS 8040) - case 4553582 - We have removed default administrator account and replaced with our customer account who has admin access to that server and has access to Netapp as backup administrator role. See other details from NetApp below Hey Steve, So in this circumstance, the filer will try to validate the owner sid before writing it as the owner. That is where the failure occurs…. Because the filer doesn’t know who the owner is (most likely it is a local user to that machine or something). We actually have filed an RFE for the filer to bypass this check, that RFE number is 1163115. As of right now, the only work around is to first change the owner of the source filesystem, to something that the filer can understand (in this case, we switched it to a domain user to which the filer was also joined).