{"record":{"id":"aeb7c14560475b51","repo":"projectdiscovery/nuclei","slug":"lsa-openpolicy2-w","errorCode":null,"errorMessage":"lsa OpenPolicy2: %w","messagePattern":"lsa OpenPolicy2: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/dcerpc.go","lineNumber":485,"sourceCode":"// const r = c.LsaLookupSids(['S-1-5-21-...-500']);\n// log(to_json(r));\n// ```\nfunc (c *Client) LsaLookupSids(sids []string) ([]LookupResult, error) {\n\tc.nj.Require(len(sids) > 0, \"at least one SID must be provided\")\n\trpc, err := c.rpcOverNamedPipe(\"lsarpc\", gplsa.UUID, gplsa.MajorVersion, gplsa.MinorVersion)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer func() {\n\t\t_ = rpc.Transport.Close()\n\t}()\n\n\tlsa, err := gplsa.NewLsaClient(rpc)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"lsa init: %w\", err)\n\t}\n\tif err := lsa.OpenPolicy2(); err != nil {\n\t\treturn nil, fmt.Errorf(\"lsa OpenPolicy2: %w\", err)\n\t}\n\tdefer lsa.Close()\n\treturn lsa.LookupSids(sids)\n}\n","sourceCodeStart":467,"sourceCodeEnd":490,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/dcerpc.go#L467-L490","documentation":"lsa.OpenPolicy2() failed in LsaLookupSids: the server refused to open an LSA policy handle. SID lookup requires policy access that hardened configurations restrict to authenticated (sometimes admin) callers; anonymous/restricted tokens receive ACCESS_DENIED here. The bind and client init succeeded — this is policy-open authorization.","triggerScenarios":"LsaLookupSids() with null/guest creds, 'Restrict anonymous access to Named Pipes' style hardening, or a caller missing 'Access this computer from the network' rights.","commonSituations":"Anonymous enumeration defenses on DCs; service accounts stripped of logon rights; wrong domain again — policy open is domain-scoped.","solutions":["Use authenticated domain user credentials.","Verify the account holds 'Access this computer from the network' on the target.","Check anonymous-restriction hardening; retry as admin if present.","Confirm the SID list is well-formed so a later failure is not misread as this one."],"exampleFix":"// before\nconst c = new dcerpc.Client('dc01', 'ACME', '', '');\nc.LsaLookupSids(['S-1-5-32-544']); // lsa OpenPolicy2: ACCESS_DENIED\n\n// after\nconst c = new dcerpc.Client('dc01', 'ACME', 'svc-scan', 'S3cure!pass');\nc.LsaLookupSids(['S-1-5-32-544']);","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const r = c.LsaLookupSids(sids);\n} catch (e) {\n  const msg = String(e);\n  if (msg.includes('OpenPolicy2')) {\n    // policy handle denied: insufficient rights or anonymous restriction\n    log('LSA policy open denied: ' + msg);\n  } else throw e;\n}","preventionTips":["Use domain user credentials with 'Access this computer from the network' rights.","Validate SID syntax before the call so unrelated failures are not conflated.","Cache lookup results and batch SIDs to minimize policy opens."],"tags":["lsarpc","lsa","authorization","sid","dcerpc"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}