How to fix Error 552 on Windows 11

by

Windows 11 Troubleshooting Guide: Error 552 – “The Passed ACL Did Not Contain the Minimum Required Information”

Why This Error Happens

Error 552 occurs when Windows attempts to apply or read a Security Descriptor whose Access Control List (ACL) is malformed, truncated, or missing mandatory Access Control Entries (ACEs) — most commonly the SYSTEM or Administrators ACE required by the Security Reference Monitor. This typically happens after a corrupted permission inheritance chain, a botched manual edit of NTFS permissions via icacls or SetACL, or a registry key/service object whose security descriptor was damaged during a failed update or malware cleanup. Third-party permission-hardening tools and improperly restored backups are also frequent culprits, as they can write incomplete ACL structures that the OS rejects outright.

Step-by-Step Resolution Guide

  1. Identify the affected object — Check Event Viewer (Win + X → Event Viewer → Windows Logs → System/Application) for the exact file, folder, registry key, or service tied to Error 552. Note the full path.

  2. Reset NTFS permissions to inherited defaults (for files/folders):
    Open Command Prompt as Administrator and run:

   icacls "C:\Path\To\Object" /reset /T /C

The /T applies recursively, and /C continues past errors on individual items.

  1. Rebuild the security descriptor from a known-good baseline (for registry keys):
  • Open regedit as Administrator.
  • Navigate to the affected key (e.g., HKLM\SYSTEM\CurrentControlSet\Services\...).
  • Right-click → Permissions → Advanced → click “Disable inheritance”, then “Convert to explicit permissions.”
  • Re-add SYSTEM (Full Control) and Administrators (Full Control) manually if missing.
  1. For service-related ACL corruption, reset the service’s security descriptor using sc sdset:
   sc sdset <ServiceName> D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

This restores the default Windows SDDL string for standard services.

  1. Run System File Checker and DISM to repair any underlying corrupted system files that may be generating malformed default ACLs:
   sfc /scannow
   DISM /Online /Cleanup-Image /RestoreHealth

Alternative or Verification Steps

  • Verify the fix: Re-run icacls "C:\Path\To\Object" and confirm SYSTEM and Administrators appear with Full Control (F), and re-trigger the original action (install, service start, etc.) to confirm Error 552 no longer appears in Event Viewer.
  • Alternative: If the object is a critical system file/registry key and permissions can’t be reset manually, use System Restore to roll back to a restore point created before the corruption occurred.