Error applying security: failed to enumerate objects in the container
error applying security failed to enumerate
Also searched as
- error applying security information failed to enumerate objects in the container
- failed to enumerate objects in the container access is denied
- syteline folder permissions error applying security
Short answer
This Windows error means you tried to change permissions on a folder and Windows could not read everything inside it. It is almost always caused by missing ownership or permissions on a child item, so take ownership of the folder tree as an administrator and then reapply permissions. It shows up in SyteLine and Mongoose installs when app folders, IIS content or share folders were created by another account.
Applies to: Windows Server 2016 to 2022 and Windows 10/11. Applies to any folder, including Infor SyteLine, Mongoose, IIS and report folders.
Fix the error
- 1Open an elevated prompt (Run as administrator). Do this even if you are a member of the Administrators group.
- 2Take ownership of the tree: takeown /f "D:\path\to\folder" /r /d y
- 3Grant the Administrators group full control: icacls "D:\path\to\folder" /grant Administrators:(OI)(CI)F /t
- 4Retry the change in Properties > Security > Advanced, or apply the permission you need with icacls instead of the UI.
- 5If it still fails, find a single bad item: run icacls on subfolders one by one, or check for paths longer than 260 characters.
- 6Stop services or IIS app pools that hold files open (for example the application pool of the SyteLine web client) and retry.
- 7Check antivirus or backup agents that lock files or deny access, and exclude the folder temporarily if your policy allows.
- 8Reset the inheritance and ACL cleanly if the tree is broken: icacls "D:\path" /reset /t /c
What the message really says
The full text is usually 'Error applying security. An error occurred while applying security information to: path. Failed to enumerate objects in the container. Access is denied.' Windows is trying to apply a permission change to a folder and all children, and it cannot list a folder it has no right to read.
So the fix is about rights on the offending subfolder, not about the folder you right-clicked. Ownership is the key, because an owner can always rewrite the ACL.
Why it happens in ERP environments
ERP servers accumulate folders created by installers, service accounts, former administrators and domain accounts that no longer exist. Restoring from backup, moving folders between servers and copying install media all produce items with orphaned owners.
In SyteLine environments you see it on IIS content folders, report output and attachment shares, and the Mongoose or application folder when changing the service account that runs it.
takeown /f "D:\Infor\Sample" /r /d y icacls "D:\Infor\Sample" /grant Administrators:(OI)(CI)F /t /c icacls "D:\Infor\Sample" /grant "DOMAIN\svc-app":(OI)(CI)M /t /c
Special cases
Network shares: you need the share permission and the NTFS permission. If the share is on a NAS, make the change on the NAS or as the right account, because the Windows UI cannot always edit it.
Long paths and reserved names can also block enumeration. Shorten the path or use the extended path prefix. Mounted volumes, junction points and system-protected folders such as System Volume Information should not be edited this way.
Do not just disable security
A common shortcut is to grant Everyone full control. That fixes the error and creates an audit finding, especially for ERP data and attachment folders that hold financial or export-controlled documents.
Use a named service account with the minimum rights the application documents, and keep the change in your change log.
Try it here, free
Container Loading Capacity Calculator
Estimate cartons per container by volume and by weight, see which limit binds and how full the container is.
Common pitfalls
- !Using the Properties dialog from a non-elevated session and getting the same error again.
- !Granting Everyone full control as a quick fix on an ERP or document folder.
- !Recursing over a share root or system folder instead of the application folder.
- !Forgetting to restart the service or app pool after changing its account permissions.
- !Ignoring antivirus or backup agents that hold locks on the files.
How an ERP-grounded AI assistant handles this
A private, on-prem assistant can walk an administrator through this on the actual server without any file path or folder name leaving the network. It can read the icacls output you paste, spot the orphaned owner and draft the exact commands. Execution stays with the administrator.
Frequently asked questions
What does 'failed to enumerate objects in the container' mean?
Windows could not list the contents of a folder when applying permissions to it and its children. Usually the account running the change lacks rights on a subfolder or an item has an orphaned owner.
Why do I get it even as administrator?
Your session may not be elevated, or the item has an owner and ACL that exclude Administrators. Run an elevated prompt and use takeown first, then icacls.
Is it safe to run takeown on an application folder?
Generally yes for application and data folders you administer, since it only changes ownership. Do not run it on system folders, and note it in your change log.
Does this error come from SyteLine itself?
No. It is a Windows permissions error. It appears around SyteLine installs because of the folders, services and IIS content they use.
Related
SyteLine error: an error has occurred during report processing
This generic SSRS error in SyteLine usually comes from one of three sources: the client cannot reach the configured report server URL, the report's data source credentials or connection string are wrong, or the report definition itself has a parameter or dataset problem. Check the report server URL setting in SyteLine first, then confirm the report is actually deployed to that server, then look at the SSRS server's own execution log for the real underlying error.
Error fixSyteLine: License Limit Reached and Users Cannot Log In
When SyteLine refuses a login because the license or session limit is reached, the usual cause is not too many real users but stale sessions that were never released: killed browsers, dropped VPNs, service accounts and integrations holding connections open. Find the sessions in the application's session management form, release the dead ones, then fix whatever keeps leaking them.
AdvancedHow to Set Up Multi-Site Configuration in SyteLine
SyteLine supports multiple manufacturing or distribution sites either as separate Site records within one shared database, or as fully separate databases linked through intersite transactions and, in CloudSuite Industrial, ION. Getting the site model right up front, shared versus separate master data, intersite transfer setup, avoids a painful data migration later.
Error fixFixing SyteLine's 'Object reference not set to an instance of an object' error
This is a generic .NET NullReferenceException surfacing through the SyteLine IDO Runtime, not a SyteLine-specific error code. It almost always means a form, script or IDO method referenced a field, row or object that came back null, usually after a customization, a missing related record, or a view/IDO method call before the form finished loading. Turn on detailed client logging and check the most recent customization or form event first.
Error fixDiagnosing and fixing SyteLine session timeout errors
SyteLine session timeouts come from one of three independent layers: the IDO Data Service session timeout on the app server, the IIS/application pool idle timeout for the web (Mongoose Web) client, or a load balancer/proxy idle timeout in front of a CloudSuite hosted environment. Fixing the wrong layer is the most common mistake - you need to identify which layer is actually expiring the session before changing anything.
Error fixResolving SyteLine multi-site replication conflict errors
A replication conflict in SyteLine's multi-site architecture means the same record (commonly an item, customer, or BOM) was changed independently at two sites between replication cycles, and the replication engine could not automatically merge the two versions. Check the replication conflict log first to see which record and which fields collided, then decide which site's version should win before resuming the queue.
AI for ERPAn Air-Gapped Private LLM for SyteLine, Built for Defense Suppliers
Deploy a private LLM on an air-gapped network alongside Infor SyteLine for defense suppliers: no internet egress, ITAR and CMMC-aware architecture.
Stuck on Windows Server (Infor SyteLine / CSI installs)?
Talk to engineers who work inside Windows Server (Infor SyteLine / CSI installs) every week, and who build private AI that answers these questions from your own ERP data.
Keep exploring
Free tools
- Container Loading Capacity CalculatorEstimate cartons per container by volume and by weight, see which limit binds and how full the container is.
- Windows Security Event ID Reference for Threat HuntingThe event IDs a small security team should log and alert on, from failed logons and new services to cleared logs and PowerShell script blocks.
- SyteLine Security and User Access Audit ChecklistA checklist for reviewing SyteLine users, authorizations, service accounts and integrations before an audit or after a staffing change.
ERP fixes and how-tos
- SyteLine error: an error has occurred during report processingWhy SyteLine reports fail with 'an error has occurred during report processing' or cannot reach the report server, and how to fix the SSRS connection, deployment, or parameter cause.
- How to change a SyteLine (CSI) passwordHow a user changes a SyteLine / CSI password, how an admin resets it in Mongoose user setup, and what changes with ION SSO or Windows authentication.
- SyteLine APS error 30012: what to check before rerunningTroubleshoot SyteLine APS error 30012: check the APS service, data sync between SyteLine and APS, then rerun the schedule. A tested order of checks.
Guides
- How to Configure User Security Groups in SyteLineStep-by-step guide to configuring user security groups in Infor SyteLine CloudSuite Industrial. Set up group hierarchies, form permissions, and IDO-level access controls.
- Configuring IDO Security and Role Permissions in SyteLineConfigure SyteLine IDO-level security and role-based permissions. Control read, insert, update, and delete access per IDO, property, and user group in CloudSuite Industrial.
- Configuring Security Groups in SyteLineConfigure security groups in Infor SyteLine to control form access, field visibility, and data permissions. Step-by-step guide for role-based security administration.
Troubleshooting
- Why SentencePiece tokenizer loading or conversion fails, and how to fix itSentencePiece errors usually mean the package is missing, the tokenizer.model file is missing or corrupted, or a fast/slow tokenizer conversion failed. Fix each cleanly.
- Why NVIDIA driver installation fails on Ubuntu, and how to fix itThe top cause of NVIDIA driver install failures on Ubuntu is Secure Boot rejecting the unsigned kernel module. Enroll the MOK key or disable Secure Boot.