{"record":{"id":"2c1a353ef981e599","repo":"rustdesk/rustdesk","slug":"failed-to-open-process-token-error","errorCode":null,"errorMessage":"Failed to open process token, error {}","messagePattern":"Failed to open process token, error (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/platform/windows.rs","lineNumber":2499,"sourceCode":"}\n\npub fn is_elevated(process_id: Option<DWORD>) -> ResultType<bool> {\n    use base::platform::windows::RAIIHandle;\n    unsafe {\n        let handle: HANDLE = match process_id {\n            Some(process_id) => OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, process_id),\n            None => GetCurrentProcess(),\n        };\n        if handle == NULL {\n            bail!(\n                \"Failed to open process, error {}\",\n                io::Error::last_os_error()\n            )\n        }\n        let _handle = RAIIHandle(handle);\n        let mut token: HANDLE = mem::zeroed();\n        if OpenProcessToken(handle, TOKEN_QUERY, &mut token) == FALSE {\n            bail!(\n                \"Failed to open process token, error {}\",\n                io::Error::last_os_error()\n            )\n        }\n        let _token = RAIIHandle(token);\n        let mut token_elevation: TOKEN_ELEVATION = mem::zeroed();\n        let mut size: DWORD = 0;\n        if GetTokenInformation(\n            token,\n            TokenElevation,\n            (&mut token_elevation) as *mut _ as *mut c_void,\n            mem::size_of::<TOKEN_ELEVATION>() as _,\n            &mut size,\n        ) == FALSE\n        {\n            bail!(\n                \"Failed to get token information, error {}\",\n                io::Error::last_os_error()","sourceCodeStart":2481,"sourceCodeEnd":2517,"githubUrl":"https://github.com/rustdesk/rustdesk/blob/91c9fccbb0f7bfe5f11644d5fbdec9b23fa10540/src/platform/windows.rs#L2481-L2517","documentation":"`OpenProcessToken(handle, TOKEN_QUERY, &mut token)` returned FALSE, so no query handle to the process's primary token could be obtained; the Win32 last error is included. The process handle was opened successfully, but the token request itself was denied or invalid.","triggerScenarios":"The elevation-check helper (src/platform/windows.rs:2499) after a successful `OpenProcess`: fails when the caller lacks TOKEN_QUERY rights on the target token (target at higher integrity), the handle lacks required access, or the target is a protected process.","commonSituations":"Standard-user process querying a SYSTEM service's token, security software stripping token access, or querying a process that exited between OpenProcess and OpenProcessToken.","solutions":["Elevate the caller (admin) before querying other users'/SYSTEM processes' tokens","Request the process handle with the access rights that include token query (`PROCESS_QUERY_LIMITED_INFORMATION` is already minimal — consider `PROCESS_QUERY_INFORMATION` if policy allows)","Re-acquire the PID and retry if the process may have terminated mid-check","If the target belongs to another session, run the check within that session's context (e.g. from the service)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if OpenProcessToken(handle, TOKEN_QUERY, &mut token) == 0 {\n    let err = io::Error::last_os_error();\n    if err.raw_os_error() == Some(5) { /* elevate and retry */ }\n    return Err(err.into());\n}","preventionTips":["Query only tokens of processes at or below your integrity level","Keep the process handle open until the token query completes","Run token inspections from the service (SYSTEM) context when targeting other sessions"],"tags":["windows","win32","token","access-denied"],"backgroundTag":"permission-denied","analyzedSha":"91c9fccbb0f7bfe5f11644d5fbdec9b23fa10540","analyzedAt":"2026-09-10T19:53:44.083Z","contentChangedAt":"2026-09-10T19:53:44.083Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}