The error only occurs when copying file security, e.g. by specifying /SEC or /COPYALL on the Robocopy command line. If file security is not copied, all files are copied successfully, and no errors are reported.
The error is usually caused by the CIFS file server returning invalid security information for a file. For example, if the CIFS file server returns a NULL Security ID (SID) for a file's Owner, or a file's Primary Group, when Robocopy tries to copy this information to the destination file, Windows will return error 87 "The parameter is incorrect" or error 1338 "The security descriptor is invalid". This is by design - file security information in Windows is expected to contain both Owner and Primary Group SIDs.
On the CIFS file server, use the appropriate tools to correct the security information for affected files, and ensure that all affected files have both an Owner SID and a Primary Group SID.
This is by design - file security information in Windows is expected to contain both Owner and Primary Group SIDs. For more information about Security Descriptors and Access Control Lists: