{"record":{"id":"346cde17861da76f","repo":"crowdsecurity/crowdsec","slug":"while-duplicating-token-w","errorCode":null,"errorMessage":"while duplicating token: %w","messagePattern":"while duplicating token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils_windows.go","lineNumber":174,"sourceCode":"}\n\nfunc getProcessAttr() (*windows.SysProcAttr, error) {\n\tvar procToken, token windows.Token\n\n\tproc := windows.CurrentProcess()\n\tdefer windows.CloseHandle(proc)\n\n\terr := windows.OpenProcessToken(proc, windows.TOKEN_DUPLICATE|windows.TOKEN_ADJUST_DEFAULT|\n\t\twindows.TOKEN_QUERY|windows.TOKEN_ASSIGN_PRIMARY|windows.TOKEN_ADJUST_GROUPS|windows.TOKEN_ADJUST_PRIVILEGES, &procToken)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while opening process token: %w\", err)\n\t}\n\tdefer procToken.Close()\n\n\terr = windows.DuplicateTokenEx(procToken, 0, nil, windows.SecurityImpersonation,\n\t\twindows.TokenPrimary, &token)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while duplicating token: %w\", err)\n\t}\n\n\t//Remove all privileges from the token\n\n\terr = windows.AdjustTokenPrivileges(token, true, nil, 0, nil, nil)\n\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while adjusting token privileges: %w\", err)\n\t}\n\n\t//Run the plugin as a medium integrity level process\n\t//For some reasons, low level integrity don't work, the plugin and crowdsec cannot communicate over the TCP socket\n\tsid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinMediumLabelSid))\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\ttml := &windows.Tokenmandatorylabel{}","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils_windows.go#L156-L192","documentation":"This error wraps a failure from windows.DuplicateTokenEx, which clones the crowdsec process token into a new primary token that will be assigned to the plugin subprocess. It is thrown when the OS rejects the duplication — usually because the source token lacks the rights needed to duplicate it (TOKEN_DUPLICATE) or the caller lacks SeAssignPrimaryTokenPrivilege context.","triggerScenarios":"getProcessAttr, called from PluginBroker.CreateCmd when launching a plugin on Windows, fails at DuplicateTokenEx(procToken, 0, nil, SecurityImpersonation, TokenPrimary, &token) — e.g. the token was opened without TOKEN_DUPLICATE, or the security descriptor prevents duplication.","commonSituations":"EDR/security software blocking DuplicateTokenEx; running under an account with a restricted token; attempting duplication in an environment (e.g. some service contexts, containers, or jobs) where token duplication is denied.","solutions":["Ensure crowdsec runs as an account allowed to duplicate its own token (LocalSystem/admin service account).","Check EDR/AV logs for blocked token-duplication calls and whitelist the crowdsec binary.","Verify OpenProcessToken was called with TOKEN_DUPLICATE included in the access mask (it is by default; a modified build may omit it).","Test DuplicateTokenEx in isolation with a small Go probe to capture the exact Win32 error code."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Ensure the source token carries TOKEN_DUPLICATE before duplicating\nif err := windows.OpenProcessToken(proc, windows.TOKEN_DUPLICATE|windows.TOKEN_QUERY, &procToken); err != nil {\n    return fmt.Errorf(\"cannot obtain duplicable token: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"cmd, err := broker.CreateCmd(ctx, binaryPath)\nif err != nil {\n    var errno syscall.Errno\n    if errors.As(err, &errno) && errno == windows.ERROR_ACCESS_DENIED {\n        log.Error(\"token duplication denied; check EDR policy and service account privileges\")\n    }\n    return err\n}","preventionTips":["Verify the token access mask includes TOKEN_DUPLICATE before DuplicateTokenEx.","Confirm EDR products do not flag duplicate-token operations for crowdsec.","Use a standard service account; avoid heavily restricted sandbox accounts.","Test plugin launching after any Windows security baseline change."],"tags":["windows","token-duplication","privilege"],"backgroundTag":"insufficient-permissions","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}