crowdsecurity/crowdsec · error

while creating built-in Administrators well known sid: %w

Error message

while creating built-in Administrators well known sid: %w

What it means

CheckPerms builds SID references for the well-known SYSTEM and Administrators accounts before comparing them against the plugin file's owner. This error wraps a failure from windows.CreateWellKnownSid(WinBuiltinAdministratorsSid), the Win32 CreateWellKnownSid API, meaning Windows itself refused to construct the BUILTIN\Administrators SID. It is effectively an OS-level/system-call failure, not a user configuration mistake.

Source

Thrown at pkg/csplugin/utils_windows.go:68

	AceSize    uint16
	AccessMask uint32
	SidStart   uint32
}

const ACCESS_ALLOWED_ACE_TYPE = 0
const ACCESS_DENIED_ACE_TYPE = 1

func CheckPerms(path string) error {
	log.Debugf("checking permissions of %s\n", path)

	systemSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinLocalSystemSid))
	if err != nil {
		return fmt.Errorf("while creating SYSTEM well known sid: %w", err)
	}

	adminSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinBuiltinAdministratorsSid))
	if err != nil {
		return fmt.Errorf("while creating built-in Administrators well known sid: %w", err)
	}

	currentUser, err := user.Current()
	if err != nil {
		return fmt.Errorf("while getting current user: %w", err)
	}

	currentUserSid, _, _, err := windows.LookupSID("", currentUser.Username)

	if err != nil {
		return fmt.Errorf("while looking up current user sid: %w", err)
	}

	sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)
	if err != nil {
		return fmt.Errorf("while getting owner security info: %w", err)
	}
	if !sd.IsValid() {

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped %w Win32 error to identify the underlying cause and check the Windows version/service-pack
2. Verify the process runs on a genuine Windows host (not a partial Wine/sandbox environment)
3. Update Windows / rerun on a healthy machine, since CreateWellKnownSid failing for a built-in SID indicates an OS-level problem
4. Report upstream to crowdsec if reproducible on a standard Windows install, as this path should virtually never fail

Example fix

// before
adminSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinBuiltinAdministratorsSid))
if err != nil {
	return fmt.Errorf("while creating built-in Administrators well known sid: %w", err)
}
// after
// Log the underlying Win32 code for diagnosability
adminSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinBuiltinAdministratorsSid))
if err != nil {
	return fmt.Errorf("while creating built-in Administrators well known sid (err=%d): %w", windows.GetLastError(), err)
}

if runtime.GOOS != "windows" {
	return errors.New("CheckPerms is only supported on Windows")
}
if _, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinBuiltinAdministratorsSid)); err != nil {
	return fmt.Errorf("environment cannot create well-known SIDs: %w", err)
}

err := CheckPerms(pluginPath)
if err != nil {
	if strings.Contains(err.Error(), "well known sid") {
		log.Warnf("OS failed to create well-known SID, skipping plugin perm check: %v", err)
	} else {
		return err
	}
}

When it happens

Trigger: Calling CheckPerms (via pluginIsValid during plugin discovery) on Windows when the CreateWellKnownSid syscall for WinBuiltinAdministratorsSid fails — typically an underlying Win32 error such as ERROR_INVALID_PARAMETER or a corrupted/failed advapi32 call.

Common situations: Running on a heavily hardened or non-standard Windows installation where well-known SID creation is restricted; running inside a restricted sandbox/container-emulation layer; buggy security software hooking advapi32; extremely rare OS API regressions after Windows updates.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

• while creating SYSTEM well known sid: %w
• while looking up current user sid: %w
• while getting ACE: %w
• security descriptor is invalid
• owner is invalid

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/4fab3716a30022d5. Report an issue: GitHub.