{"record":{"id":"4cbd504aeddb5708","repo":"babalae/better-genshin-impact","slug":"windows-sid","errorCode":null,"errorMessage":"无法取得当前 Windows 用户 SID。","messagePattern":"无法取得当前 Windows 用户 SID。","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"BetterGenshinImpact/Service/Instance/InstanceBootstrap.cs","lineNumber":286,"sourceCode":"                return null;\n            }\n        }\n\n        return null;\n    }\n}\n\ninternal sealed record InitialRootConnection(\n    NamedPipeClientStream Client,\n    ConnectionOpenResponse Response);\n\ninternal static class InstancePipeFactory\n{\n    internal static NamedPipeServerStream CreateServer(string pipeName, bool firstPipeInstance)\n    {\n        using var identity = WindowsIdentity.GetCurrent();\n        var ownerSid = identity.User\n                       ?? throw new InvalidOperationException(\"无法取得当前 Windows 用户 SID。\");\n        var networkSid = new SecurityIdentifier(WellKnownSidType.NetworkSid, null);\n        var security = new PipeSecurity();\n        security.SetAccessRuleProtection(isProtected: true, preserveInheritance: false);\n        security.SetOwner(ownerSid);\n        security.AddAccessRule(new PipeAccessRule(\n            networkSid,\n            PipeAccessRights.FullControl,\n            AccessControlType.Deny));\n        security.AddAccessRule(new PipeAccessRule(\n            ownerSid,\n            PipeAccessRights.FullControl,\n            AccessControlType.Allow));\n        var options = PipeOptions.Asynchronous | PipeOptions.WriteThrough;\n        if (firstPipeInstance)\n        {\n            options |= PipeOptions.FirstPipeInstance;\n        }\n","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/babalae/better-genshin-impact/blob/a7cb36712dcb409be610257d877fcea3597e9d6b/BetterGenshinImpact/Service/Instance/InstanceBootstrap.cs#L268-L304","documentation":"Thrown by InstancePipeFactory.CreateServer when WindowsIdentity.GetCurrent().User is null — the current security principal has no user SID, so the named pipe ACL cannot be scoped to the current user (the pipe security denies network access and grants the owner full control, both keyed off the SID).","triggerScenarios":"Running BetterGI under an account whose WindowsIdentity.User is null: certain service accounts, anonymous/low-privilege sandboxes, or environments where the user token has no user SID (e.g. some containerized or virtualized Windows hosts).","commonSituations":"BetterGI launched from a service context or a non-interactive account; a broken user profile; running under a custom principal that does not map to a Windows user SID.","solutions":["Run BetterGI as a normal interactive Windows user account (the same account used for the desktop session).","Verify the account has a valid user SID via `whoami /user` — it must list an SID.","If running in automation, use an account with a real user SID rather than SYSTEM-without-profile."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"using var identity = WindowsIdentity.GetCurrent();\nif (identity.User is null)\n{\n    throw new InvalidOperationException(\"无法取得当前 Windows 用户 SID。\");\n}","typeGuard":null,"tryCatchPattern":"try\n{\n    var server = InstancePipeFactory.CreateServer(pipeName, firstPipeInstance: true);\n}\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"SID\"))\n{\n    logger.LogCritical(ex, \"No user SID; run BetterGI as an interactive Windows user\");\n}","preventionTips":["Run BetterGI as a normal interactive Windows user account that has a user SID.","Verify the account with `whoami /user` before automating launches.","Avoid service accounts whose tokens lack a user SID."],"tags":["windows","identity","security","environment","named-pipe"],"backgroundTag":null,"analyzedSha":"a7cb36712dcb409be610257d877fcea3597e9d6b","analyzedAt":"2026-08-13T16:44:57.548Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}