How to fix Error 1361 on Windows 11

by

Troubleshooting Guide: Error 1361 – Security Descriptor Format Issue

Why This Error Happens

Error 1361 occurs when Windows encounters a security descriptor (SD) that is malformed or does not conform to either the absolute or self-relative format required by the Security Reference Monitor. This typically results from corrupted Access Control Lists (ACLs) on a file, registry key, or Active Directory object, often caused by improper API calls from third-party software, incomplete system updates, or disk-level corruption affecting the NTFS security metadata. In some cases, a botched permissions migration or a faulty backup restoration process can also introduce this inconsistency.

Step-by-Step Resolution Guide

Step 1: Run System File and Disk Checks

  • Open Command Prompt as Administrator.
  • Execute sfc /scannow to repair corrupted system files that may store security descriptor templates.
  • Follow up with chkdsk C: /f /r and restart the machine if prompted, as this fixes underlying disk corruption affecting NTFS metadata.

Step 2: Reset Permissions on the Affected Object

  • Identify the specific file, folder, or registry key throwing the error (check Event Viewer under Windows Logs > Application for the exact path).
  • Open an elevated Command Prompt and use icacls "C:\Path\To\Object" /reset /T /C to strip and rebuild the ACL in a valid format.
  • For registry keys, navigate to the key in regedit, right-click Permissions > Advanced, and click Disable Inheritance, then Restore defaults.

Step 3: Rebuild the Security Descriptor via PowerShell

  • Launch PowerShell as Administrator.
  • Use the Get-Acl and Set-Acl cmdlets to copy a known-good security descriptor from a working object of the same type: $acl = Get-Acl "C:\Working\Reference"; Set-Acl "C:\Broken\Target" $acl.
  • If the issue is on a domain object, use dsacls or ntdsutil to verify the descriptor’s integrity against the Schema Master.

Step 4: Check for Third-Party Software Interference

  • Uninstall or update any security/antivirus software recently installed, as some tools improperly write custom ACLs.
  • Check %ProgramData% and application logs for the software that last modified the object’s permissions.

Step 5: Restore from a Backup or System Restore Point

  • If the descriptor remains corrupted, use File History or a VSS snapshot to restore the specific file/folder to a state prior to the error.
  • Alternatively, boot into Advanced Startup Options and select a System Restore point dated before the error first appeared.

Alternative or Verification Steps

  • Verify the fix by re-triggering the action that caused the error (e.g., re-running the application or accessing the specific file) and checking Event Viewer to confirm Error 1361 no longer logs.
  • If the error persists on a specific file only, try copying the data to a new file/folder (which inherits a fresh, valid ACL) rather than repairing the existing one.