{"record":{"id":"4fab3716a30022d5","repo":"crowdsecurity/crowdsec","slug":"while-creating-built-in-administrators-well-known","errorCode":null,"errorMessage":"while creating built-in Administrators well known sid: %w","messagePattern":"while creating built-in Administrators well known sid: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils_windows.go","lineNumber":68,"sourceCode":"\tAceSize    uint16\n\tAccessMask uint32\n\tSidStart   uint32\n}\n\nconst ACCESS_ALLOWED_ACE_TYPE = 0\nconst ACCESS_DENIED_ACE_TYPE = 1\n\nfunc CheckPerms(path string) error {\n\tlog.Debugf(\"checking permissions of %s\\n\", path)\n\n\tsystemSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinLocalSystemSid))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating SYSTEM well known sid: %w\", err)\n\t}\n\n\tadminSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinBuiltinAdministratorsSid))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating built-in Administrators well known sid: %w\", err)\n\t}\n\n\tcurrentUser, err := user.Current()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting current user: %w\", err)\n\t}\n\n\tcurrentUserSid, _, _, err := windows.LookupSID(\"\", currentUser.Username)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while looking up current user sid: %w\", err)\n\t}\n\n\tsd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting owner security info: %w\", err)\n\t}\n\tif !sd.IsValid() {","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils_windows.go#L50-L86","documentation":"CheckPerms builds SID references for the well-known SYSTEM and Administrators accounts before comparing them against the plugin file's owner. This error wraps a failure from windows.CreateWellKnownSid(WinBuiltinAdministratorsSid), the Win32 CreateWellKnownSid API, meaning Windows itself refused to construct the BUILTIN\\Administrators SID. It is effectively an OS-level/system-call failure, not a user configuration mistake.","triggerScenarios":"Calling CheckPerms (via pluginIsValid during plugin discovery) on Windows when the CreateWellKnownSid syscall for WinBuiltinAdministratorsSid fails — typically an underlying Win32 error such as ERROR_INVALID_PARAMETER or a corrupted/failed advapi32 call.","commonSituations":"Running on a heavily hardened or non-standard Windows installation where well-known SID creation is restricted; running inside a restricted sandbox/container-emulation layer; buggy security software hooking advapi32; extremely rare OS API regressions after Windows updates.","solutions":["Read the wrapped %w Win32 error to identify the underlying cause and check the Windows version/service-pack","Verify the process runs on a genuine Windows host (not a partial Wine/sandbox environment)","Update Windows / rerun on a healthy machine, since CreateWellKnownSid failing for a built-in SID indicates an OS-level problem","Report upstream to crowdsec if reproducible on a standard Windows install, as this path should virtually never fail"],"exampleFix":"// before\nadminSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinBuiltinAdministratorsSid))\nif err != nil {\n\treturn fmt.Errorf(\"while creating built-in Administrators well known sid: %w\", err)\n}\n// after\n// Log the underlying Win32 code for diagnosability\nadminSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinBuiltinAdministratorsSid))\nif err != nil {\n\treturn fmt.Errorf(\"while creating built-in Administrators well known sid (err=%d): %w\", windows.GetLastError(), err)\n}","handlingStrategy":"try-catch","validationCode":"if runtime.GOOS != \"windows\" {\n\treturn errors.New(\"CheckPerms is only supported on Windows\")\n}\nif _, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinBuiltinAdministratorsSid)); err != nil {\n\treturn fmt.Errorf(\"environment cannot create well-known SIDs: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"err := CheckPerms(pluginPath)\nif err != nil {\n\tif strings.Contains(err.Error(), \"well known sid\") {\n\t\tlog.Warnf(\"OS failed to create well-known SID, skipping plugin perm check: %v\", err)\n\t} else {\n\t\treturn err\n\t}\n}","preventionTips":["Run only on genuine, up-to-date Windows hosts","Keep antivirus/EDR from hooking advapi32 calls for the crowdsec process","Log the wrapped Win32 error for OS-level diagnosis"],"tags":["windows","sid","security","win32"],"backgroundTag":"unsupported-platform","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}