{"record":{"id":"28dc44d6a44b65c2","repo":"peass-ng/PEASS-ng","slug":"0-gettokeninformation-failed-with-error-1","errorCode":null,"errorMessage":"{0}: GetTokenInformation failed with error: {1}","messagePattern":"(.+?): GetTokenInformation failed with error: (.+?)","errorType":"exception","errorClass":"Win32Exception","httpStatus":null,"severity":"warning","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/AlphaFS/Security/ProcessContext.cs","lineNumber":142,"sourceCode":"         SafeTokenHandle tokenHandle;\n\n         var success = NativeMethods.OpenProcessToken(Process.GetCurrentProcess().Handle, NativeMethods.TOKEN.TOKEN_READ, out tokenHandle);\n\n         var lastError = Marshal.GetLastWin32Error();\n         if (!success)\n            throw new Win32Exception(lastError, string.Format(CultureInfo.CurrentCulture, \"{0}: OpenProcessToken failed with error: {1}\", MethodBase.GetCurrentMethod().Name, lastError.ToString(CultureInfo.CurrentCulture)));\n\n\n         using (tokenHandle)\n         using (var safeBuffer = new SafeGlobalMemoryBufferHandle(Marshal.SizeOf(Enum.GetUnderlyingType(typeof(NativeMethods.TOKEN_ELEVATION_TYPE)))))\n         {\n            uint bytesReturned;\n            success = NativeMethods.GetTokenInformation(tokenHandle, NativeMethods.TOKEN_INFORMATION_CLASS.TokenElevationType, safeBuffer, (uint) safeBuffer.Capacity, out bytesReturned);\n\n            lastError = Marshal.GetLastWin32Error();\n\n            if (!success)\n               throw new Win32Exception(lastError, string.Format(CultureInfo.CurrentCulture, \"{0}: GetTokenInformation failed with error: {1}\", MethodBase.GetCurrentMethod().Name, lastError.ToString(CultureInfo.CurrentCulture)));\n\n\n            return (NativeMethods.TOKEN_ELEVATION_TYPE) safeBuffer.ReadInt32();\n         }\n      }\n   }\n}\n","sourceCodeStart":124,"sourceCodeEnd":150,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/AlphaFS/Security/ProcessContext.cs#L124-L150","documentation":"GetProcessElevationType calls the Win32 API GetTokenInformation to query TokenElevationType for the current process token. When the API call fails, it throws a Win32Exception wrapping the last Win32 error code, indicating the elevation type could not be determined. This is a defensive wrapper around a native call that fails only when the token handle or buffer is invalid.","triggerScenarios":"GetTokenInformation returns false, typically because tokenHandle is invalid or closed, safeBuffer has insufficient Capacity for TOKEN_ELEVATION_TYPE, or the token was opened with insufficient access rights (TOKEN_QUERY missing).","commonSituations":"Running in restricted environments (service contexts, AppContainer, restricted job objects) where the process token cannot be queried; antivirus or host-hardening blocking token queries; corrupted handle reuse after token disposal.","solutions":["Ensure the token handle was obtained successfully via OpenProcessToken/OpenThreadToken with TOKEN_QUERY access before calling GetProcessElevationType.","Verify safeBuffer.Capacity is at least 4 bytes (size of TOKEN_ELEVATION_TYPE) and the buffer is not disposed.","Wrap the call in try-catch and treat failure as 'elevation unknown' rather than crashing the enumeration.","Run the process with sufficient privileges or check IsElevatedProcess via alternative means (e.g. WindowsIdentity) if token queries are blocked."],"exampleFix":"// before\nbool elevated = IsElevatedProcess();\n// after\nbool elevated;\ntry { elevated = IsElevatedProcess(); }\ncatch (Win32Exception) { elevated = false; } // elevation unknown, assume not elevated","handlingStrategy":"try-catch","validationCode":"// check token validity before querying\nif (tokenHandle == null || tokenHandle.IsInvalid || tokenHandle.IsClosed)\n    throw new InvalidOperationException(\"No valid process token handle\");\n// buffer must hold a uint (4 bytes)\nif (safeBuffer == null || safeBuffer.Capacity < sizeof(uint))\n    throw new ArgumentException(\"Buffer too small for TOKEN_ELEVATION_TYPE\");","typeGuard":"static bool IsValidToken(SafeTokenHandle h) => h != null && !h.IsInvalid && !h.IsClosed;","tryCatchPattern":"bool elevated;\ntry {\n    elevated = IsElevatedProcess();\n} catch (Win32Exception ex) {\n    // ex.NativeErrorCode holds the Win32 error\n    Log.Warn(\"Elevation query failed: \" + ex.NativeErrorCode);\n    elevated = false; // graceful degradation\n}","preventionTips":["Always open the token with TOKEN_QUERY access and check for success before GetTokenInformation","Keep the SafeBuffer alive (not disposed) across the native call","Initialize lastError via Marshal.GetLastWin32Error immediately after the P/Invoke with SetLastError=true on the DllImport","Treat token-query failures as 'unknown elevation' in restricted environments instead of crashing"],"tags":["win32","pinvoke","token","windows","privileges"],"backgroundTag":"win32-api-call-failed","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}