{"record":{"id":"4b64f1c19a4abd8f","repo":"crowdsecurity/crowdsec","slug":"while-adjusting-token-privileges-w","errorCode":null,"errorMessage":"while adjusting token privileges: %w","messagePattern":"while adjusting token privileges: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils_windows.go","lineNumber":182,"sourceCode":"\terr := windows.OpenProcessToken(proc, windows.TOKEN_DUPLICATE|windows.TOKEN_ADJUST_DEFAULT|\n\t\twindows.TOKEN_QUERY|windows.TOKEN_ASSIGN_PRIMARY|windows.TOKEN_ADJUST_GROUPS|windows.TOKEN_ADJUST_PRIVILEGES, &procToken)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while opening process token: %w\", err)\n\t}\n\tdefer procToken.Close()\n\n\terr = windows.DuplicateTokenEx(procToken, 0, nil, windows.SecurityImpersonation,\n\t\twindows.TokenPrimary, &token)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while duplicating token: %w\", err)\n\t}\n\n\t//Remove all privileges from the token\n\n\terr = windows.AdjustTokenPrivileges(token, true, nil, 0, nil, nil)\n\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while adjusting token privileges: %w\", err)\n\t}\n\n\t//Run the plugin as a medium integrity level process\n\t//For some reasons, low level integrity don't work, the plugin and crowdsec cannot communicate over the TCP socket\n\tsid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinMediumLabelSid))\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\ttml := &windows.Tokenmandatorylabel{}\n\ttml.Label.Attributes = windows.SE_GROUP_INTEGRITY\n\ttml.Label.Sid = sid\n\n\terr = windows.SetTokenInformation(token, windows.TokenIntegrityLevel,\n\t\t(*byte)(unsafe.Pointer(tml)), tml.Size())\n\tif err != nil {\n\t\ttoken.Close()\n\t\treturn nil, fmt.Errorf(\"while setting token information: %w\", err)","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils_windows.go#L164-L200","documentation":"This error wraps a failure from windows.AdjustTokenPrivileges, which is called with DisableAllPrivileges=true to strip every privilege from the duplicated token so the plugin runs with minimal rights. It is thrown when the Win32 call returns an error (as opposed to returning success with GetLastWin32Error=ERROR_NOT_ALL_ASSIGNED, which is not treated as failure here since all privileges are being disabled).","triggerScenarios":"getProcessAttr, called from PluginBroker.CreateCmd during plugin startup on Windows, fails at AdjustTokenPrivileges(token, true, nil, 0, nil, nil) — e.g. the token handle is invalid or the caller lacks rights to modify the token's privileges.","commonSituations":"Token handle already closed/invalid after a failed earlier step; security software tampering with token modification calls; corrupt token state from a failed DuplicateTokenEx; running in a hardened service context that forbids AdjustTokenPrivileges.","solutions":["Fix the root cause reported by earlier steps: ensure OpenProcessToken and DuplicateTokenEx succeeded so the token handle is valid.","Verify the caller has the rights needed to adjust the token (the token was created by the same process, so this usually indicates EDR interference).","Capture the wrapped syscall.Errno in logs to identify ERROR_INVALID_HANDLE vs ERROR_ACCESS_DENIED.","Reboot/restart the service to clear a corrupted token state if the same code works in a clean environment."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Token validity can be probed before adjusting privileges\nif token == 0 {\n    return fmt.Errorf(\"token handle invalid before AdjustTokenPrivileges\")\n}","typeGuard":null,"tryCatchPattern":"cmd, err := broker.CreateCmd(ctx, binaryPath)\nif err != nil {\n    var errno syscall.Errno\n    if errors.As(err, &errno) && errno == windows.ERROR_INVALID_HANDLE {\n        log.Error(\"privilege adjustment failed on invalid token; check earlier token steps\")\n    }\n    return err\n}","preventionTips":["Make sure OpenProcessToken and DuplicateTokenEx succeeded before adjusting privileges.","Always close token handles only after all operations complete to avoid invalid-handle errors.","Check EDR interference if AdjustTokenPrivileges is blocked in hardened environments.","Capture syscall.Errno from the wrapped error for precise diagnosis."],"tags":["windows","privileges","token"],"backgroundTag":"insufficient-permissions","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}