{"record":{"id":"ec98b24abe787edb","repo":"crowdsecurity/crowdsec","slug":"plugin-at-s-is-not-owned-by-system-administrator","errorCode":null,"errorMessage":"plugin at %s is not owned by SYSTEM, Administrators or by current user, but by %s","messagePattern":"plugin at (.+?) is not owned by SYSTEM, Administrators or by current user, but by (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils_windows.go","lineNumber":98,"sourceCode":"\t}\n\n\tsd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting owner security info: %w\", err)\n\t}\n\tif !sd.IsValid() {\n\t\treturn errors.New(\"security descriptor is invalid\")\n\t}\n\towner, _, err := sd.Owner()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting owner: %w\", err)\n\t}\n\tif !owner.IsValid() {\n\t\treturn errors.New(\"owner is invalid\")\n\t}\n\n\tif !owner.Equals(systemSid) && !owner.Equals(currentUserSid) && !owner.Equals(adminSid) {\n\t\treturn fmt.Errorf(\"plugin at %s is not owned by SYSTEM, Administrators or by current user, but by %s\", path, owner.String())\n\t}\n\n\tdacl, _, err := sd.DACL()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting DACL: %w\", err)\n\t}\n\n\tif dacl == nil {\n\t\treturn fmt.Errorf(\"no DACL found on plugin, meaning fully permissive access on plugin %s\", path)\n\t}\n\n\trs := reflect.ValueOf(dacl).Elem()\n\n\t/*\n\t\t\tFor reference, the structure of the ACL type is:\n\t\t\ttype ACL struct {\n\t\t\taclRevision byte\n\t\t\tsbz1        byte","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils_windows.go#L80-L116","documentation":"This is a deliberate security-policy rejection, not a system failure. CheckPerms verifies the plugin binary's owner is SYSTEM, BUILTIN\\Administrators, or the user running crowdsec; if a regular/unprivileged account owns the file, any such account could silently replace the binary with malicious code that crowdsec would execute. The error names the offending owner SID.","triggerScenarios":"Calling CheckPerms (via pluginIsValid, during plugin discovery) on a plugin binary whose NTFS owner is a normal user account — e.g. a plugin installed by hand by a non-admin user, extracted from an archive preserving an odd owner, or copied onto the machine by a non-elevated process.","commonSituations":"Plugins unzipped by a logged-in user instead of an elevated installer; plugins deployed by CI/CD or scripts running as a service account different from crowdsec's; files restored from backups with rewritten ownership; plugins in a user-profile folder rather than a system plugin directory.","solutions":["Take ownership as an administrator: `icacls <plugin> /setowner Administrators` or takeown.exe","Reinstall the plugins using an elevated installer/process so files are owned by Administrators","Move plugins to the standard install directory and set ownership there","Verify with `icacls <plugin>` that the owner is SYSTEM, Administrators, or crowdsec's service account"],"exampleFix":"// before\n# plugin copied by user 'dev' → owner dev\nC:\\ProgramData\\crowdsec\\plugins> icacls notify-email.exe\n... Owner: CORP\\dev\n// after\n# run elevated\nicacls \"C:\\ProgramData\\crowdsec\\plugins\\notify-email.exe\" /setowner Administrators","handlingStrategy":"validation","validationCode":"func pluginOwnerIsTrusted(path string) error {\n\tsd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION)\n\tif err != nil {\n\t\treturn err\n\t}\n\towner, _, err := sd.Owner()\n\tif err != nil {\n\t\treturn err\n\t}\n\ts, err := owner.String()\n\tif err != nil {\n\t\treturn err\n\t}\n\tswitch s {\n\tcase \"S-1-5-18\", \"S-1-5-32-544\": // SYSTEM, Administrators\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\"untrusted owner %s on %s\", s, path)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Install plugins with an elevated installer so ownership is Administrators","Never leave plugin files owned by interactive users","Check `icacls <plugin>` after any manual copy or extraction","Deploy plugins via scripts that run as SYSTEM"],"tags":["windows","security","permissions","plugins"],"backgroundTag":"insufficient-permissions","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}