{"record":{"id":"e943dbca11a492f3","repo":"cloudflare/cloudflared","slug":"create-token-file-w","errorCode":null,"errorMessage":"create token file: %w","messagePattern":"create token file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/windows_service.go","lineNumber":167,"sourceCode":"\t\treturn fmt.Errorf(\"convert path to UTF-16: %w\", err)\n\t}\n\n\tf, err := windows.CreateFile(\n\t\tpathRaw,\n\t\twindows.GENERIC_WRITE,\n\t\t0,\n\t\t&windows.SecurityAttributes{\n\t\t\tLength:             uint32(unsafe.Sizeof(windows.SecurityAttributes{})),\n\t\t\tSecurityDescriptor: sd,\n\t\t\tInheritHandle:      0,\n\t\t},\n\t\twindows.CREATE_ALWAYS, // Will truncate the file if it exists\n\t\twindows.FILE_ATTRIBUTE_NORMAL,\n\t\t0,\n\t)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create token file: %w\", err)\n\t}\n\n\tif err := windows.CloseHandle(f); err != nil {\n\t\treturn fmt.Errorf(\"close token file: %w\", err)\n\t}\n\n\t// As with os.CreateFile / os.OpenFile on Unix, if the file already exists\n\t// windows.CreateFile will not update the permission information, so we do\n\t// that explicitly after creating the file.\n\n\towner, _, err := sd.Owner()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"get token file owner: %w\", err)\n\t}\n\n\tdacl, _, err := sd.DACL()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"get token file DACL: %w\", err)","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/windows_service.go#L149-L185","documentation":"createTokenFile calls the Win32 API windows.CreateFile with GENERIC_WRITE, CREATE_ALWAYS and FILE_ATTRIBUTE_NORMAL to create (or truncate) the service access-token file. If the underlying Win32 CreateFile call fails, cloudflared wraps the Win32 error with this message. Because CREATE_ALWAYS is used, the token file is recreated on every service install.","triggerScenarios":"The Win32 CreateFile call in createTokenFile returns a non-nil error (e.g. invalid handle parameters, path problems, sharing violations).","commonSituations":"The target directory does not exist or the path is malformed; another process holds the file open with a conflicting share mode; disk-full or read-only volume; overly restrictive ACLs on the parent directory.","solutions":["Verify the parent directory exists: if PROGRAMDATA\\Cloudflare was removed, reinstall the service after recreating it","Check the file is not locked/open by another process (Resource Monitor or handle.exe)","Run the install from an elevated prompt so Administrators can write under %PROGRAMDATA%","Inspect the wrapped Win32 error code in the message (e.g. Access is denied, The system cannot find the path specified) and address it specifically"],"exampleFix":"// before\nf, err := windows.CreateFile(pathRaw, windows.GENERIC_WRITE, 0, nil, windows.CREATE_ALWAYS, windows.FILE_ATTRIBUTE_NORMAL, 0)\nif err != nil {\n\treturn fmt.Errorf(\"create token file: %w\", err)\n}\n// after\nif err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {\n\treturn fmt.Errorf(\"ensure config dir: %w\", err)\n}\nf, err := windows.CreateFile(pathRaw, windows.GENERIC_WRITE, 0, nil, windows.CREATE_ALWAYS, windows.FILE_ATTRIBUTE_NORMAL, 0)\nif err != nil {\n\treturn fmt.Errorf(\"create token file: %w\", err)\n}","handlingStrategy":"try-catch","validationCode":"// PowerShell: verify target dir exists and is writable before install\n$dir = Join-Path $env:PROGRAMDATA 'Cloudflare'\nif (-Not (Test-Path $dir)) { New-Item -ItemType Directory -Path $dir | Out-Null }\ntry { [IO.File]::OpenWrite((Join-Path $dir 'token')).Close() } catch { Write-Error \"Cannot write to $dir: $_\"; exit 1 }","typeGuard":null,"tryCatchPattern":"if err := createTokenFile(path); err != nil {\n\tif strings.Contains(err.Error(), \"create token file\") {\n\t\t_ = os.MkdirAll(filepath.Dir(path), 0o755) // ensure parent dir, then retry once\n\t\tif retryErr := createTokenFile(path); retryErr != nil { return retryErr }\n\t\treturn nil\n\t}\n\treturn err\n}","preventionTips":["Ensure %PROGRAMDATA%\\Cloudflare exists before installing the service","Install from an elevated prompt so ACLs permit writing","Check for conflicting share-mode locks (AV scanners, backup agents) on the token file","Keep the system volume from running out of disk space"],"tags":["windows","file-io","win32"],"backgroundTag":"file-open-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}