title: Trying to set ProcessStrictHandleCheckPolicy returns 87 - Incorrect Function
body: <p>I am trying to use <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/hh769088(v=vs.85).aspx" rel="nofollow"><code>SetProcessMitigationPolicy</code></a> on Windows 10 to enable the <strong>ProcessStrictHandleCheckPolicy</strong>:</p>
  
  <blockquote>
    <p>The process will receive a fatal error if it manipulates a handle that is not valid.</p>
    
    <p>As a general rule, strict handle checking cannot be turned off once it is turned on. Therefore, when calling the <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/hh769088(v=vs.85).aspx" rel="nofollow">SetProcessMitigationPolicy</a> function with this policy, the values of the <strong>RaiseExceptionOnInvalidHandleReference</strong> and <strong>HandleExceptionsPermanentlyEnabled</strong> substructure members must be the same. It is not possible to enable invalid handle exceptions only temporarily.</p>
  </blockquote>
  
  <p>I can enable a number of the other mitigations:</p>
  
  <ul>
  <li><strong><code>ProcessDynamicCodePolicy</code></strong>: The dynamic code policy of the process. When turned on, the process cannot generate dynamic code or modify existing executable code.</li>
  <li><strong><code>ProcessExtensionPointDisablePolicy</code></strong>: Contains process mitigation policy settings for legacy extension point DLLs.</li>
  <li><strong><code>ProcessSignaturePolicy</code></strong>: The policy of a process that can restrict image loading to those images that are either signed by Microsoft, by the Windows Store, or by Microsoft, the Windows Store and the Windows Hardware Quality Labs (WHQL).</li>
  <li><strong><code>ProcessFontDisablePolicy</code></strong>: The policy regarding font loading for the process. When turned on, the process cannot load non-system fonts.</li>
  <li><strong><code>ProcessImageLoadPolicy</code></strong>: The policy regarding image loading for the process, which determines the types of executable images that are allowed to be mapped into the process. When turned on, images cannot be loaded from some locations, such a remote devices or files that have the low mandatory label.</li>
  </ul>
  
  <p>But <strong>ProcessStrictHandleCheckPolicy</strong>:</p>
  
  <pre><code>PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY policy;
  policy.RaiseExceptionOnInvalidHandleReference = 1;
  policy.HandleExceptionsPermanentlyEnabled = 1;
  
  BOOL res = SetProcessMitigationPolicy(ProcessStrictHandleCheckPolicy, policy, sizeof(policy));
  
  if (!res) 
     RaiseLastWin32Error();
  </code></pre>
  
  <p>fails with error code 87:</p>
  
  <blockquote>
    <p><strong>ERROR_INVALID_PARAMETER</strong><br>
    The parameter is incorrect</p>
  </blockquote>
  
  <p>What is wrong?</p>
  
  <h2>Bonus Chatter</h2>
  
  <p>The <strong>ProcessDynamicCodePolicy</strong> policy prevents an embedded web browser from running Javascript:</p>
  
  <ul>
  <li><strong><code>ProhibitDynamicCode</code></strong>: Set (0x1) to prevent the process from generating dynamic code or modifying existing executable code; otherwise leave unset (0x0).</li>
  <li><strong><code>AllowThreadOptOut</code></strong>: Set (0x1) to allow threads to opt out of the restrictions on dynamic code generation by calling the <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/hh448390(v=vs.85).aspx" rel="nofollow">SetThreadInformation</a> function with the ThreadInformation parameter set to <strong>ThreadDynamicCodePolicy</strong>; otherwise leave unset (0x0). You should not use the <strong>AllowThreadOptOut</strong> and <strong>ThreadDynamicCodePolicy</strong> settings together to provide strong security. These settings are only intended to enable applications to adapt their code more easily for full dynamic code restrictions.</li>
  </ul>
  
  <h2>More Bonuser</h2>
  
  <p>I'm actually in Delphi, so the syntax is different from the above C/C++/C# pseudo-code:</p>
  
  <pre><code>type
      //ProcessStrictHandleCheckPolicy - The process will receive a fatal error if it manipulates an invalid handle. Useful for preventing downstream problems in a process due to handle misuse.
      PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY = record
          Flags: DWORD;
                  //DWORD RaiseExceptionOnInvalidHandleReference : 1;
                  //DWORD HandleExceptionsPermanentlyEnabled : 1;
                  //DWORD ReservedFlags : 30;
      end;
  
  procedure SetMitigationPolicy;
  var
      policy: PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY;
      res: BOOL;
  begin
      policy.Flags := $00000002;
      res := SetProcessMitigationPolicy(ProcessStrictHandleCheckPolicy, @policy, sizeof(policy));
      if not res then
          RaiseLastWin32Error;
  end;
  </code></pre>
  
  <p>It doesn't change the question:</p>
  
  <ul>
  <li>sometimes when i post Delphi code, and it's not strictly Delphi related, i get comments that i should have included the Delphi tag</li>
  <li>sometimes when i post Delphi code, and it's not strictly Delphi related, i get comments that i should not have included the Delphi tag</li>
  </ul>
  
  <p><em>rolls the dice</em></p>
  
  <p>Don't include <kbd>delphi</kbd> <kbd>delphi-xe6</kbd> tags.</p>
  
  <h2>Bonus Reading</h2>
  
  <ul>
  <li><a href="https://blogs.msdn.microsoft.com/oldnewthing/20161027-00/?p=94586" rel="nofollow">How to electrify your own fence: ProcessStrictHandleCheckPolicy</a></li>
  </ul>