crowdsecurity/crowdsec · error

while creating SYSTEM well known sid: %w

Error message

while creating SYSTEM well known sid: %w

What it means

On Windows, CheckPerms builds the well-known SYSTEM SID via windows.CreateWellKnownSid(WinLocalSystemSid) as the first step of validating plugin ACLs. If that Win32-backed call fails, the error is wrapped with this message. This is an OS API failure, not a config problem, and would indicate a badly broken Windows security subsystem.

Source

Thrown at pkg/csplugin/utils_windows.go:63

}

type AccessAllowedAce struct {
	AceType    uint8
	AceFlags   uint8
	AceSize    uint16
	AccessMask uint32
	SidStart   uint32
}

const ACCESS_ALLOWED_ACE_TYPE = 0
const ACCESS_DENIED_ACE_TYPE = 1

func CheckPerms(path string) error {
	log.Debugf("checking permissions of %s\n", path)

	systemSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinLocalSystemSid))
	if err != nil {
		return fmt.Errorf("while creating SYSTEM well known sid: %w", err)
	}

	adminSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinBuiltinAdministratorsSid))
	if err != nil {
		return fmt.Errorf("while creating built-in Administrators well known sid: %w", err)
	}

	currentUser, err := user.Current()
	if err != nil {
		return fmt.Errorf("while getting current user: %w", err)
	}

	currentUserSid, _, _, err := windows.LookupSID("", currentUser.Username)

	if err != nil {
		return fmt.Errorf("while looking up current user sid: %w", err)
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped %w cause for the underlying Windows error code
2. Restart the machine / check the Windows security subsystem (lsass) health
3. If it occurs in a Windows container, verify the base image supports SID creation APIs and try a full Windows host

if err := CheckPerms(path); err != nil {
    var werr syscall.Errno
    if errors.As(err, &werr) {
        log.Fatalf("windows API failure creating SYSTEM SID (errno %d): %v", werr, err)
    }
    return err
}

When it happens

Trigger: CheckPerms (invoked from pluginIsValid on Windows builds) calls windows.CreateWellKnownSid for WinLocalSystemSid and the underlying API returns FALSE, producing a Windows error — effectively only when the process token or the OS security environment is corrupt.

Common situations: Running on a heavily restricted or non-genuine Windows environment; broken win32 API/token in a minimal or emulated Windows container; extremely rare in practice.

Related errors

• while creating built-in Administrators well known sid: %w
• while looking up current user sid: %w
• token value for api.server.auto_register is too short (min 3
• security descriptor is invalid
• owner is invalid

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/26bcc6463d3551af. Report an issue: GitHub.