cloudflare/cloudflared · error

set token file security info: %w

Error message

set token file security info: %w

What it means

Finally, createTokenFile calls Win32 SetSecurityInformation (with OWNER_SECURITY_INFORMATION and DACL_SECURITY_INFORMATION) to stamp the owner and restrictive DACL onto the freshly created token file. If that Win32 call fails, cloudflared wraps the error with this message, and the service install aborts (the caller cleans up the token file).

Source

Thrown at cmd/cloudflared/windows_service.go:209

	//	-> Set file owner
	// DACL_SECURITY_INFORMATION
	// 	-> Set ACEs
	// PROTECTED_DACL_SECURITY_INFORMATION
	//  -> Update DACL to be "protected' such that it cannot inherit entries from its parent
	const securityInfo = windows.OWNER_SECURITY_INFORMATION |
		windows.DACL_SECURITY_INFORMATION |
		windows.PROTECTED_DACL_SECURITY_INFORMATION

	if err := windows.SetNamedSecurityInfo(
		path,
		windows.SE_FILE_OBJECT,
		securityInfo,
		owner,
		nil,
		dacl,
		nil,
	); err != nil {
		return fmt.Errorf("set token file security info: %w", err)
	}

	return nil
}

type windowsService struct {
	app            *cli.App
	graceShutdownC chan struct{}
}

// Execute is called by the service manager when service starts, the state
// of the service will be set to Stopped when this function returns.
func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeRequest, statusChan chan<- svc.Status) (ssec bool, errno uint32) {
	log := logger.Create(nil)
	elog, err := eventlog.Open(windowsServiceName)
	if err != nil {
		log.Err(err).Msgf("Cannot open event log for %s", windowsServiceName)
		return

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Run `cloudflared service install` from an elevated (Run as Administrator) prompt
2. Check for Group Policy/AV software resetting ACLs on %PROGRAMDATA% paths
3. Verify the CreateFile handle is opened with the access rights needed to write security info (e.g. include WRITE_DAC/WRITE_OWNER in desired access)
4. Check the wrapped Win32 code in the message (e.g. 'Access is denied') and address the specific denial

Example fix

// before
f, err := windows.CreateFile(pathRaw, windows.GENERIC_WRITE, 0, nil, windows.CREATE_ALWAYS, windows.FILE_ATTRIBUTE_NORMAL, 0)
// after
const desiredAccess = windows.GENERIC_WRITE | windows.WRITE_DAC | windows.WRITE_OWNER
f, err := windows.CreateFile(pathRaw, desiredAccess, 0, nil, windows.CREATE_ALWAYS, windows.FILE_ATTRIBUTE_NORMAL, 0)

# PowerShell pre-check: is the session elevated?
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-Not $isAdmin) { Write-Error 'Run cloudflared service install as Administrator'; exit 1 }

if err := installWindowsService(ctx); err != nil {
	if strings.Contains(err.Error(), "set token file security info") {
		log.Error().Msg("could not stamp ACL on token file; run as Administrator and check GPO/AV interference")
	}
	return err
}

When it happens

Trigger: windows.SetSecurityInformation fails on the token file handle after CreateFile succeeded — the caller lacks WRITE_OWNER/WRITE_DAC rights on the file, or the handle lacks the needed access bits.

Common situations: Running the service install without elevation so the process cannot set owner to BUILTIN\Administrators; Group Policy or antivirus interfering with ACL changes under %PROGRAMDATA%; the file handle was opened without sufficient desired-access flags.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• The file-writing error is: %v / The delete tunnel error is:
• cloudflared service is already installed at ${service}; if y
• create config dir at %s: %w
• create token file at %s: %w
• chmod token file at %s: %w

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/1c591077dee10f49. Report an issue: GitHub.