{"record":{"id":"af3e81898653fb69","repo":"go-delve/delve","slug":"could-not-acquire-debug-privilege-opencurrentproc","errorCode":null,"errorMessage":"could not acquire debug privilege (OpenCurrentProcessToken): %v","messagePattern":"could not acquire debug privilege \\(OpenCurrentProcessToken\\): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/proc/native/proc_windows.go","lineNumber":199,"sourceCode":"\ttgt, err := dbp.initialize(exepath, []string{})\n\tif err != nil {\n\t\tdetachWithoutGroup(dbp, true)\n\t\treturn nil, err\n\t}\n\treturn tgt, nil\n}\n\n// acquireDebugPrivilege acquires the debug privilege which is needed to\n// debug other user's processes.\n// See:\n//\n//   - https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debug-privilege\n//   - https://github.com/go-delve/delve/issues/3136\nfunc acquireDebugPrivilege() error {\n\tvar token sys.Token\n\terr := sys.OpenProcessToken(sys.CurrentProcess(), sys.TOKEN_QUERY|sys.TOKEN_ADJUST_PRIVILEGES, &token)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not acquire debug privilege (OpenCurrentProcessToken): %v\", err)\n\t}\n\tdefer token.Close()\n\n\tprivName, _ := sys.UTF16FromString(\"SeDebugPrivilege\")\n\tvar luid sys.LUID\n\terr = sys.LookupPrivilegeValue(nil, &privName[0], &luid)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not acquire debug privilege  (LookupPrivilegeValue): %v\", err)\n\t}\n\n\tvar tp sys.Tokenprivileges\n\ttp.PrivilegeCount = 1\n\ttp.Privileges[0].Luid = luid\n\ttp.Privileges[0].Attributes = sys.SE_PRIVILEGE_ENABLED\n\n\terr = sys.AdjustTokenPrivileges(token, false, &tp, 0, nil, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not acquire debug privilege (AdjustTokenPrivileges): %v\", err)","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/go-delve/delve/blob/a23773e6c31361e43246bc43a424ee009679b174/pkg/proc/native/proc_windows.go#L181-L217","documentation":"acquireDebugPrivilege tries to enable SeDebugPrivilege on Delve's own process token so it can attach to processes it does not own. The first step opens the current process token with TOKEN_QUERY|TOKEN_ADJUST_PRIVILEGES via OpenProcessToken; if that Win32 call fails, this wrapped error is returned.","triggerScenarios":"Calling Attach on Windows when OpenProcessToken fails — token handle exhaustion, restricted token, or the API returning an error such as ERROR_ACCESS_DENIED.","commonSituations":"Running Delve inside a heavily restricted service account or AppContainer/Sandbox; corrupted user profile/token; running from a non-interactive session without an accessible process token.","solutions":["Run Delve from a normal elevated (Administrator) command prompt instead of a service/sandboxed context.","Check that the process token is accessible: `whoami /priv` should list privileges.","Verify no security policy (GPO/EDR) is blocking token access; consult `gpresult` or EDR logs.","If under AppContainer/jail, move execution outside the sandbox before attaching."],"exampleFix":"// before (non-interactive service context)\nc:> dlv attach 4242\n// after\nc:> runas /user:Administrator cmd\nc:> whoami /priv   // confirm token works\nc:> dlv attach 4242","handlingStrategy":"validation","validationCode":"// powershell: confirm the token is usable before debugging\nwhoami /priv | Select-String SeDebugPrivilege","typeGuard":null,"tryCatchPattern":"if err := dbg.Attach(pid, nil); err != nil {\n    if strings.Contains(err.Error(), \"OpenCurrentProcessToken\") {\n        // token unavailable: rerun elevated / outside sandbox\n    }\n}","preventionTips":["Launch the debugger from an interactive elevated session.","Do not run the debugger under AppContainer or hardened service accounts.","Check security software that blocks token operations."],"tags":["windows","privileges","token","attach"],"backgroundTag":"debug-privilege-not-enabled","analyzedSha":"a23773e6c31361e43246bc43a424ee009679b174","analyzedAt":"2026-08-31T15:12:45.221Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}