{"record":{"id":"1c591077dee10f49","repo":"cloudflare/cloudflared","slug":"set-token-file-security-info-w","errorCode":null,"errorMessage":"set token file security info: %w","messagePattern":"set token file security info: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/windows_service.go","lineNumber":209,"sourceCode":"\t//\t-> Set file owner\n\t// DACL_SECURITY_INFORMATION\n\t// \t-> Set ACEs\n\t// PROTECTED_DACL_SECURITY_INFORMATION\n\t//  -> Update DACL to be \"protected' such that it cannot inherit entries from its parent\n\tconst securityInfo = windows.OWNER_SECURITY_INFORMATION |\n\t\twindows.DACL_SECURITY_INFORMATION |\n\t\twindows.PROTECTED_DACL_SECURITY_INFORMATION\n\n\tif err := windows.SetNamedSecurityInfo(\n\t\tpath,\n\t\twindows.SE_FILE_OBJECT,\n\t\tsecurityInfo,\n\t\towner,\n\t\tnil,\n\t\tdacl,\n\t\tnil,\n\t); err != nil {\n\t\treturn fmt.Errorf(\"set token file security info: %w\", err)\n\t}\n\n\treturn nil\n}\n\ntype windowsService struct {\n\tapp            *cli.App\n\tgraceShutdownC chan struct{}\n}\n\n// Execute is called by the service manager when service starts, the state\n// of the service will be set to Stopped when this function returns.\nfunc (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeRequest, statusChan chan<- svc.Status) (ssec bool, errno uint32) {\n\tlog := logger.Create(nil)\n\telog, err := eventlog.Open(windowsServiceName)\n\tif err != nil {\n\t\tlog.Err(err).Msgf(\"Cannot open event log for %s\", windowsServiceName)\n\t\treturn","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/windows_service.go#L191-L227","documentation":"Finally, createTokenFile calls Win32 SetSecurityInformation (with OWNER_SECURITY_INFORMATION and DACL_SECURITY_INFORMATION) to stamp the owner and restrictive DACL onto the freshly created token file. If that Win32 call fails, cloudflared wraps the error with this message, and the service install aborts (the caller cleans up the token file).","triggerScenarios":"windows.SetSecurityInformation fails on the token file handle after CreateFile succeeded — the caller lacks WRITE_OWNER/WRITE_DAC rights on the file, or the handle lacks the needed access bits.","commonSituations":"Running the service install without elevation so the process cannot set owner to BUILTIN\\Administrators; Group Policy or antivirus interfering with ACL changes under %PROGRAMDATA%; the file handle was opened without sufficient desired-access flags.","solutions":["Run `cloudflared service install` from an elevated (Run as Administrator) prompt","Check for Group Policy/AV software resetting ACLs on %PROGRAMDATA% paths","Verify the CreateFile handle is opened with the access rights needed to write security info (e.g. include WRITE_DAC/WRITE_OWNER in desired access)","Check the wrapped Win32 code in the message (e.g. 'Access is denied') and address the specific denial"],"exampleFix":"// before\nf, err := windows.CreateFile(pathRaw, windows.GENERIC_WRITE, 0, nil, windows.CREATE_ALWAYS, windows.FILE_ATTRIBUTE_NORMAL, 0)\n// after\nconst desiredAccess = windows.GENERIC_WRITE | windows.WRITE_DAC | windows.WRITE_OWNER\nf, err := windows.CreateFile(pathRaw, desiredAccess, 0, nil, windows.CREATE_ALWAYS, windows.FILE_ATTRIBUTE_NORMAL, 0)","handlingStrategy":"try-catch","validationCode":"# PowerShell pre-check: is the session elevated?\n$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)\nif (-Not $isAdmin) { Write-Error 'Run cloudflared service install as Administrator'; exit 1 }","typeGuard":null,"tryCatchPattern":"if err := installWindowsService(ctx); err != nil {\n\tif strings.Contains(err.Error(), \"set token file security info\") {\n\t\tlog.Error().Msg(\"could not stamp ACL on token file; run as Administrator and check GPO/AV interference\")\n\t}\n\treturn err\n}","preventionTips":["Always run service install elevated","Verify no Group Policy or AV resets ACLs under %PROGRAMDATA%","Open the file handle with WRITE_DAC/WRITE_OWNER access when setting security info","Read the wrapped Win32 code to target the specific denial"],"tags":["windows","acl","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}