{"record":{"id":"d7a3783be2e51d8a","repo":"cloudflare/cloudflared","slug":"write-token-to-configuration-directory-at-s-w","errorCode":null,"errorMessage":"write token to configuration directory at %s: %w","messagePattern":"write token to configuration directory at (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/windows_service.go","lineNumber":345,"sourceCode":"\n\t\t// Don't use :=, if we did so we would create a new err variable and\n\t\t// shadow the outer one, causing the defer below to not have access to\n\t\t// the outer err\n\t\tvar configDir string\n\t\tconfigDir, err = getConfigDir()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"locate config dir: %w\", err)\n\t\t}\n\n\t\t// Remove token file if service install fails any point onwards from here\n\t\tdefer func() {\n\t\t\tif err != nil {\n\t\t\t\tremoveTokenFile(configDir, zeroLogger)\n\t\t\t}\n\t\t}()\n\n\t\tif err = writeTokenToConfigDir(c, configDir); err != nil {\n\t\t\treturn fmt.Errorf(\"write token to configuration directory at %s: %w\", configDir, err)\n\t\t}\n\n\t\textraArgs = buildArgsForTokenFile(configDir)\n\t}\n\n\tconfig := mgr.Config{StartType: mgr.StartAutomatic, DisplayName: windowsServiceDescription}\n\ts, err = m.CreateService(windowsServiceName, exepath, config, extraArgs...)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"Cannot install service\")\n\t}\n\tdefer s.Close()\n\tlog.Info().Msg(\"cloudflared agent service is installed\")\n\terr = eventlog.InstallAsEventCreate(windowsServiceName, eventlog.Error|eventlog.Warning|eventlog.Info)\n\tif err != nil {\n\t\ts.Delete()\n\t\treturn errors.Wrap(err, \"Cannot install event logger\")\n\t}\n","sourceCodeStart":327,"sourceCodeEnd":363,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/windows_service.go#L327-L363","documentation":"Wraps any error that occurred while writing the service token file into the cloudflared configuration directory during Windows service installation (installWindowsService). The wrapper includes the config directory path so the operator can see where the token was expected to be persisted. It is a wrapping error: the underlying cause (permissions, path, HTTP failure fetching the token) is in the %w chain.","triggerScenarios":"Running `cloudflared service install <token>` on Windows when writeTokenToConfigDir fails: config directory cannot be created or is unwritable (permission denied, read-only profile), disk full, or the token could not be obtained from the remote API. On failure the deferred hook removes any partial token file.","commonSituations":"Installing the service under an account lacking write access to %USERPROFILE%\\.cloudflared or the system config dir; running the installer from a non-elevated shell; Group Policy restricting writes; network/API errors when fetching the tunnel token.","solutions":["Check that the configuration directory exists and is writable by the installing user (create it manually and retry).","Re-run the service install from an elevated (Administrator) shell.","Inspect the wrapped cause (%w chain) printed with the error to see if it is a permission, path, or token-fetch failure and fix accordingly.","Alternatively pass the token via flags or a credentials file and avoid token-file persistence."],"exampleFix":"// before: install fails with unwritable dir\ncloudflared service install eyJ...\n// after: pre-create config dir and run elevated\nmkdir %SystemDrive%\\Cloudflare 2>nul & icacls %SystemDrive%\\Cloudflare /grant Administrators:F\ncloudflared service install eyJ...","handlingStrategy":"try-catch","validationCode":"// Go\ndir := configDir\nif st, err := os.Stat(dir); err != nil || !st.IsDir() {\n    if err := os.MkdirAll(dir, 0o700); err != nil { /* fix perms before install */ }\n}\nif f, err := os.CreateTemp(dir, \"tok\"); err != nil { /* dir not writable */ } else { f.Close(); os.Remove(f.Name()) }","typeGuard":null,"tryCatchPattern":"if err := writeTokenToConfigDir(c, configDir); err != nil {\n    var perr *fs.PathError\n    if errors.As(err, &perr) { log.Printf(\"check permissions on %s: %v\", configDir, perr) }\n    return fmt.Errorf(\"write token to configuration directory at %s: %w\", configDir, err)\n}","preventionTips":["Run service install from an elevated shell","Pre-create and permission the config directory before install","Check disk space and AV/Group-Policy write restrictions on the config dir"],"tags":["windows","service-install","token","filesystem"],"backgroundTag":"file-write-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}