crowdsecurity/crowdsec · error

while creating admin SID: %w

Error message

while creating admin SID: %w

What it means

When the file's security descriptor has no group SID, setFilePerm falls back to the built-in Administrators group via windows.CreateWellKnownSid(WinBuiltinAdministratorsSid). This error means that fallback SID creation itself failed, which is nearly impossible on healthy systems and indicates a broken OS security subsystem.

Source

Thrown at pkg/database/file_utils_windows.go:37

	currentOwner, defaulted, err := sd.Owner()

	if err != nil {
		return fmt.Errorf("while getting owner: %w", err)
	}

	log.Debugf("current owner is %s (%v) (defaulted: %v)", currentOwner.String(), currentOwner, defaulted)

	currentGroup, defaulted, err := sd.Group()

	if err != nil {
		return fmt.Errorf("while getting group: %w", err)
	}

	if currentGroup == nil {
		log.Debugf("current group is nil (defaulted: %v), using builtin admin instead", defaulted)
		currentGroup, err = windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
		if err != nil {
			return fmt.Errorf("while creating admin SID: %w", err)
		}
	}

	log.Debugf("current group is %s (%v) (defaulted: %v)", currentGroup.String(), currentGroup, defaulted)

	dacl, err := windows.ACLFromEntries(
		[]windows.EXPLICIT_ACCESS{
			{
				AccessPermissions: windows.GENERIC_ALL,
				AccessMode:        windows.GRANT_ACCESS,
				Inheritance:       windows.NO_INHERITANCE,
				Trustee: windows.TRUSTEE{
					MultipleTrusteeOperation: windows.NO_MULTIPLE_TRUSTEE,
					TrusteeForm:              windows.TRUSTEE_IS_SID,
					TrusteeType:              windows.TRUSTEE_IS_USER,
					TrusteeValue:             windows.TrusteeValueFromSID(currentOwner),
				},
			},

View on GitHub (pinned to 909b515798)

Solutions

1. Restart the machine / the crowdsec service to clear transient security subsystem failures.
2. Run crowdsec as a properly configured Windows service (per docs) rather than an ad-hoc restricted context.
3. Check for OS integrity issues (sfc /scannow) if CreateWellKnownSid keeps failing.

err := setFilePerm(path, 0600)
if err != nil {
	// transient OS security API failure: retry after service restart
	log.Warnf("setFilePerm failed, retrying after delay: %v", err)
}

When it happens

Trigger: The group SID was nil AND CreateWellKnownSid(WinBuiltinAdministratorsSid) failed — typically due to OS security API failure, memory allocation failure, or a heavily restricted/service-isolated environment.

Common situations: Running under an exotic service context or container-like isolation on Windows where WellKnownSid APIs are restricted; system-level security API corruption.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• security descriptor is invalid
• owner is invalid
• while creating SYSTEM well known sid: %w
• while creating built-in Administrators well known sid: %w
• while looking up current user sid: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e267584d559b1ef3. Report an issue: GitHub.