{"record":{"id":"44affdf4ca4a20b2","repo":"k3s-io/k3s","slug":"not-running-as-member-of-builtin-administrators-gr","errorCode":null,"errorMessage":"not running as member of BUILTIN\\Administrators group","messagePattern":"not running as member of BUILTIN\\\\Administrators group","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/util/permissions/permissions_windows.go","lineNumber":40,"sourceCode":"\t\twindows.SECURITY_BUILTIN_DOMAIN_RID,\n\t\twindows.DOMAIN_ALIAS_RID_ADMINS,\n\t\t0, 0, 0, 0, 0, 0,\n\t\t&sid)\n\tif err != nil {\n\t\treturn errors.WithMessage(err, \"failed to create Windows SID\")\n\t}\n\tdefer windows.FreeSid(sid)\n\n\t// Ref: https://github.com/golang/go/issues/28804#issuecomment-438838144\n\ttoken := windows.Token(0)\n\n\tmember, err := token.IsMember(sid)\n\tif err != nil {\n\t\treturn errors.WithMessage(err, \"failed to check group membership\")\n\t}\n\n\tif !member {\n\t\treturn errors.New(\"not running as member of BUILTIN\\\\Administrators group\")\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":22,"sourceCodeEnd":45,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/util/permissions/permissions_windows.go#L22-L45","documentation":"Windows build of IsPrivileged: it allocates the BUILTIN\\Administrators SID, opens the current process token (windows.Token(0)) and calls IsMember. If the membership query succeeds but returns false — the token does not carry the Administrators group — this error is returned. A failed query itself produces the distinct 'failed to check group membership' error.","triggerScenarios":"Calling permissions.IsPrivileged() on Windows from a non-elevated process or an account not in BUILTIN\\Administrators; a UAC-filtered token without elevation also counts.","commonSituations":"Running in a plain (non-'Run as administrator') PowerShell/RDP session; a Windows service configured under a standard account; scheduled tasks without 'run with highest privileges'.","solutions":["Run the process elevated: right-click 'Run as administrator' or Start-Process -Verb RunAs","Configure the Windows service or scheduled task under an Administrators account with highest privileges","If the error is 'failed to check group membership' instead, fix the token/SID query failure first"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"t := windows.Token(0)\nsid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)\nif err == nil {\n    if m, _ := t.IsMember(sid); !m {\n        log.Fatal(\"restart from an elevated (administrator) shell\")\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := permissions.IsPrivileged(); err != nil {\n    if strings.Contains(err.Error(), \"BUILTIN\\\\Administrators\") {\n        // privilege problem: re-run elevated rather than continuing degraded\n        log.Fatal(\"must run as administrator\")\n    }\n}","preventionTips":["Install Windows services under an Administrators account with 'run with highest privileges'","Document elevation requirements in setup scripts so operators do not hit this at runtime","Distinguish this error from 'failed to check group membership' — that one is a token query failure, not a privilege gap"],"tags":["permissions","windows","privileges","uac"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}