{"record":{"id":"d0f237ffb74f8c84","repo":"crowdsecurity/crowdsec","slug":"while-setting-token-information-w","errorCode":null,"errorMessage":"while setting token information: %w","messagePattern":"while setting token information: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils_windows.go","lineNumber":200,"sourceCode":"\t\treturn nil, fmt.Errorf(\"while adjusting token privileges: %w\", err)\n\t}\n\n\t//Run the plugin as a medium integrity level process\n\t//For some reasons, low level integrity don't work, the plugin and crowdsec cannot communicate over the TCP socket\n\tsid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinMediumLabelSid))\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\ttml := &windows.Tokenmandatorylabel{}\n\ttml.Label.Attributes = windows.SE_GROUP_INTEGRITY\n\ttml.Label.Sid = sid\n\n\terr = windows.SetTokenInformation(token, windows.TokenIntegrityLevel,\n\t\t(*byte)(unsafe.Pointer(tml)), tml.Size())\n\tif err != nil {\n\t\ttoken.Close()\n\t\treturn nil, fmt.Errorf(\"while setting token information: %w\", err)\n\t}\n\n\treturn &windows.SysProcAttr{\n\t\tCreationFlags: windows.CREATE_NEW_PROCESS_GROUP,\n\t\tToken:         syscall.Token(token),\n\t}, nil\n}\n\nfunc (*PluginBroker) CreateCmd(ctx context.Context, binaryPath string) (*exec.Cmd, error) {\n\tvar err error\n\tcmd := exec.CommandContext(ctx, binaryPath)\n\tcmd.SysProcAttr, err = getProcessAttr()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"while getting process attributes: %w\", err)\n\t}\n\treturn cmd, err\n}\n","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils_windows.go#L182-L218","documentation":"This error wraps a failure from windows.SetTokenInformation, which sets the duplicated token's integrity level to Medium (via a Tokenmandatorylabel with the WinMediumLabelSid) so the plugin runs as a medium-integrity process that can still communicate with crowdsec over the local TCP socket. It is thrown when the OS rejects the TokenIntegrityLevel update, typically because the token lacks TOKEN_ADJUST_DEFAULT access.","triggerScenarios":"getProcessAttr, called from PluginBroker.CreateCmd on Windows, fails at SetTokenInformation(token, TokenIntegrityLevel, tml, tml.Size()) — e.g. the duplicated token was created without TOKEN_ADJUST_DEFAULT in its desired access (DuplicateTokenEx is called with desiredAccess=0 here, which can be denied), or the mandatory label structure/SID is invalid.","commonSituations":"OS hardening or EDR blocking integrity-level assignment; a Windows update changing token policy; calling code that changed the DuplicateTokenEx desiredAccess mask and lost TOKEN_ADJUST_DEFAULT; invalid Tokenmandatorylabel construction after a struct change.","solutions":["Pass windows.TOKEN_ADJUST_DEFAULT (plus TOKEN_DUPLICATE|TOKEN_QUERY|TOKEN_ASSIGN_PRIMARY) as the desiredAccess argument to DuplicateTokenEx instead of 0.","Log the wrapped syscall.Errno to distinguish ERROR_ACCESS_DENIED from ERROR_INVALID_PARAMETER.","Verify the Tokenmandatorylabel struct and the medium-integrity SID are correctly built (SE_GROUP_INTEGRITY attribute set).","Check EDR/policy interference and whitelist the crowdsec binary for token operations."],"exampleFix":"// before\nerr = windows.DuplicateTokenEx(procToken, 0, nil, windows.SecurityImpersonation, windows.TokenPrimary, &token)\n// after\nerr = windows.DuplicateTokenEx(procToken, windows.TOKEN_ADJUST_DEFAULT|windows.TOKEN_ADJUST_GROUPS|windows.TOKEN_QUERY|windows.TOKEN_ASSIGN_PRIMARY, nil, windows.SecurityImpersonation, windows.TokenPrimary, &token)","handlingStrategy":"try-catch","validationCode":"// Request TOKEN_ADJUST_DEFAULT when duplicating so integrity level can be set\nerr := windows.DuplicateTokenEx(procToken,\n    windows.TOKEN_ADJUST_DEFAULT|windows.TOKEN_QUERY|windows.TOKEN_ASSIGN_PRIMARY|windows.TOKEN_DUPLICATE,\n    nil, windows.SecurityImpersonation, windows.TokenPrimary, &token)","typeGuard":null,"tryCatchPattern":"cmd, err := broker.CreateCmd(ctx, binaryPath)\nif err != nil {\n    var errno syscall.Errno\n    if errors.As(err, &errno) {\n        if errno == windows.ERROR_ACCESS_DENIED {\n            log.Error(\"cannot set token integrity level: token lacks TOKEN_ADJUST_DEFAULT\")\n        }\n    }\n    return err\n}","preventionTips":["Always include TOKEN_ADJUST_DEFAULT in the DuplicateTokenEx desiredAccess when later calling SetTokenInformation.","Keep the Tokenmandatorylabel construction aligned with the golang.org/x/sys/windows struct definition.","Re-test integrity-level assignment after Windows updates or hardening-policy changes.","Whitelist crowdsec in EDR if token-integrity modification is flagged."],"tags":["windows","integrity-level","token"],"backgroundTag":"insufficient-permissions","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}