{"record":{"id":"cb5e78fa81b3bc97","repo":"projectdiscovery/nuclei","slug":"winstation-openserver-w","errorCode":null,"errorMessage":"winstation OpenServer: %w","messagePattern":"winstation OpenServer: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/enum.go","lineNumber":155,"sourceCode":"//\t}\n//\n// ```\nfunc (c *Client) EnumProcesses() ([]ProcessEntry, error) {\n\tif !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {\n\t\treturn nil, protocolstate.ErrHostDenied.Msgf(c.Host)\n\t}\n\trpc, err := c.rpcOverNamedPipe(winstation.PipeCtxWinStation, winstation.LegacyAPIUUID, winstation.MajorVersion, winstation.MinorVersion)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer func() {\n\t\t_ = rpc.Transport.Close()\n\t}()\n\n\tlegacy := winstation.NewLegacyClient(rpc)\n\thandle, err := legacy.OpenServer()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"winstation OpenServer: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = legacy.CloseServer(handle)\n\t}()\n\n\traw, err := legacy.GetAllProcesses(handle)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn mapProcessEntries(raw), nil\n}\n\n// EnumLoggedOnUsers lists users currently known to the workstation service\n// via WKSSVC NetrWkstaUserEnum. Complements SamrEnumerateUsers (domain DB)\n// and EnumSessions (SMB sessions).\n//\n// @example\n// ```javascript","sourceCodeStart":137,"sourceCodeEnd":173,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/enum.go#L137-L173","documentation":"EnumProcesses binds the legacy WinStation API on the ctx_winstation pipe and legacy.OpenServer() failed: the terminal-services handle was refused. The Terminal Services service may not be running (Server Core, hardened builds), the caller lacks rights, or the legacy RPC surface is simply absent — this old API (nmap smb-enum-processes parity) is frequently unavailable on modern Windows.","triggerScenarios":"EnumProcesses() on hosts without Terminal Services/RDS listening on the pipe, non-admin callers, or EDR blocking ctx_winstation opens.","commonSituations":"Servers with Terminal Services disabled; expectation from nmap-era tooling that the pipe always exists; EDR watching the pipe.","solutions":["Verify the Terminal Services (termsrv) service is running on the target.","Use administrator credentials.","Prefer WMI Win32_Process enumeration via the nuclei wmi/goexec module — far more portable than the legacy WinStation API.","Confirm the pipe exists with RpcDump or a pipe listing before relying on this method."],"exampleFix":"// before\nc.EnumProcesses(); // winstation OpenServer: ...\n\n// after (prefer the portable path)\ntry {\n  log(to_json(c.EnumProcesses()));\n} catch (e) {\n  log('legacy WinStation API unavailable (' + e + '); use WMI Win32_Process instead');\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const procs = c.EnumProcesses();\n} catch (e) {\n  const msg = String(e);\n  if (msg.includes('winstation OpenServer')) {\n    // legacy WinStation handle refused: service absent or rights missing\n    log('WinStation API unavailable — prefer WMI Win32_Process: ' + msg);\n  } else throw e;\n}","preventionTips":["Prefer WMI Win32_Process for process enumeration; treat the legacy WinStation path as best-effort.","Check the Terminal Services service before relying on EnumProcesses.","Use admin credentials when the legacy API is required."],"tags":["winstation","enumeration","terminal-services","dcerpc","windows"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}