{"record":{"id":"e0ecbaf41fd4ce62","repo":"peass-ng/PEASS-ng","slug":"getcurrentwindowsidentityfailed","errorCode":null,"errorMessage":"GetCurrentWindowsIdentityFailed","messagePattern":"GetCurrentWindowsIdentityFailed","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/AlphaFS/Security/ProcessContext.cs","lineNumber":112,"sourceCode":"         {\n            WindowsIdentity windowsIdentity;\n            var principal = GetWindowsPrincipal(out windowsIdentity);\n\n            using (windowsIdentity)\n               return principal.IsInRole(new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null)) ||\n                      principal.IsInRole(new SecurityIdentifier(WellKnownSidType.ServiceSid, null));\n         }\n      }\n\n      #endregion // Properties\n\n\n      private static WindowsPrincipal GetWindowsPrincipal(out WindowsIdentity windowsIdentity)\n      {\n         windowsIdentity = WindowsIdentity.GetCurrent();\n\n         if (null == windowsIdentity)\n            throw new InvalidOperationException(Resources.GetCurrentWindowsIdentityFailed);\n\n         return new WindowsPrincipal(windowsIdentity);\n      }\n\n\n      /// <summary>[AlphaFS] Retrieves the elevation type of the current process.</summary>\n      /// <returns>A <see cref=\"NativeMethods.TOKEN_ELEVATION_TYPE\"/> value.</returns>\n      [SuppressMessage(\"Microsoft.Naming\", \"CA2204:Literals should be spelled correctly\", MessageId = \"GetTokenInformation\")]\n      [SuppressMessage(\"Microsoft.Naming\", \"CA2204:Literals should be spelled correctly\", MessageId = \"OpenProcessToken\")]\n      private static NativeMethods.TOKEN_ELEVATION_TYPE GetProcessElevationType()\n      {\n         SafeTokenHandle tokenHandle;\n\n         var success = NativeMethods.OpenProcessToken(Process.GetCurrentProcess().Handle, NativeMethods.TOKEN.TOKEN_READ, out tokenHandle);\n\n         var lastError = Marshal.GetLastWin32Error();\n         if (!success)\n            throw new Win32Exception(lastError, string.Format(CultureInfo.CurrentCulture, \"{0}: OpenProcessToken failed with error: {1}\", MethodBase.GetCurrentMethod().Name, lastError.ToString(CultureInfo.CurrentCulture)));","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/AlphaFS/Security/ProcessContext.cs#L94-L130","documentation":"GetWindowsPrincipal throws InvalidOperationException with the GetCurrentWindowsIdentityFailed resource string when WindowsIdentity.GetCurrent() returns null. The current thread's Windows identity could not be obtained, so no principal can be constructed. This indicates the process/thread is not running with a Windows identity attachable (e.g. unusual hosting or impersonation state).","triggerScenarios":"Calling ProcessContext.principal (or anything reaching GetWindowsPrincipal) when WindowsIdentity.GetCurrent() returns null — typically no Windows identity on the thread or a corrupted/anonymous token context.","commonSituations":"Running inside a non-Windows-authenticated context (e.g. certain service accounts, thread pool threads without impersonation); hosting inside environments that strip the thread token; NUnit/CI agents with odd token setups.","solutions":["Ensure the process runs under a real Windows account with a valid token","Check WindowsIdentity.GetCurrent() yourself before relying on principal and handle null","Avoid calling identity APIs from threads lacking a Windows identity; marshal the check to the main thread","Verify no code called WindowsIdentity.Impersonate/Undo in a way that left the thread anonymous"],"exampleFix":"// before\nvar principal = ProcessContext.principal;\n// after\nusing (var id = WindowsIdentity.GetCurrent())\n{\n    if (id == null) { LogNoWindowsIdentity(); return; }\n    var principal = new WindowsPrincipal(id);\n}","handlingStrategy":"try-catch","validationCode":"var id = WindowsIdentity.GetCurrent();\nif (id == null) { /* no Windows identity available; skip principal logic */ }","typeGuard":"bool HasWindowsIdentity() { try { return WindowsIdentity.GetCurrent() != null; } catch (SecurityException) { return false; } }","tryCatchPattern":"try { var p = ProcessContext.principal; }\ncatch (InvalidOperationException ex) when (ex.Message == Resources.GetCurrentWindowsIdentityFailed || ex.Message.Contains(\"identity\")) { Log(\"no Windows identity\"); UseFallbackPrincipal(); }","preventionTips":["Do not query Windows identity from anonymous/impersonation-stripped threads","Verify impersonation Impersonate/Undo pairs are balanced","Run identity-dependent checks under a real Windows account"],"tags":["security","identity","windows-identity","impersonation"],"backgroundTag":"windows-identity-null","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}