crowdsecurity/crowdsec · error

while looking up current user sid: %w

Error message

while looking up current user sid: %w

What it means

After resolving the current user, CheckPerms translates the username into a SID with windows.LookupSID("", currentUser.Username) so it can compare against the plugin's owner SID. This error wraps LookupSID failure, meaning the local security account database could not resolve the given account name to a SID.

Source

Thrown at pkg/csplugin/utils_windows.go:79

	systemSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinLocalSystemSid))
	if err != nil {
		return fmt.Errorf("while creating SYSTEM well known sid: %w", err)
	}

	adminSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinBuiltinAdministratorsSid))
	if err != nil {
		return fmt.Errorf("while creating built-in Administrators well known sid: %w", err)
	}

	currentUser, err := user.Current()
	if err != nil {
		return fmt.Errorf("while getting current user: %w", err)
	}

	currentUserSid, _, _, err := windows.LookupSID("", currentUser.Username)

	if err != nil {
		return fmt.Errorf("while looking up current user sid: %w", err)
	}

	sd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)
	if err != nil {
		return fmt.Errorf("while getting owner security info: %w", err)
	}
	if !sd.IsValid() {
		return errors.New("security descriptor is invalid")
	}
	owner, _, err := sd.Owner()
	if err != nil {
		return fmt.Errorf("while getting owner: %w", err)
	}
	if !owner.IsValid() {
		return errors.New("owner is invalid")
	}

	if !owner.Equals(systemSid) && !owner.Equals(currentUserSid) && !owner.Equals(adminSid) {

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the account running crowdsec still exists and its name resolves locally (`whoami /user`)
2. Run crowdsec under a local account instead of a domain/managed service account if the domain is unreachable
3. Convert the username to a SID via the process token (windows.OpenProcessToken + GetTokenUser) instead of name-based LookupSID
4. Read the wrapped %w error to confirm whether it's account-not-found vs. trust/domain failure

Example fix

// before
currentUserSid, _, _, err := windows.LookupSID("", currentUser.Username)
if err != nil {
	return fmt.Errorf("while looking up current user sid: %w", err)
}
// after
// Resolve SID from the process token instead of the name
var tok windows.Token
if err := windows.OpenProcessToken(windows.CurrentProcess(), windows.TOKEN_QUERY, &tok); err == nil {
	tokUser, err := tok.GetTokenUser()
	if err == nil {
		currentUserSid = tokUser.User.Sid
	}
	tok.Close()
}

u, err := user.Current()
if err == nil {
	if _, _, _, lookupErr := windows.LookupSID("", u.Username); lookupErr != nil {
		return fmt.Errorf("cannot resolve SID for %q: %w", u.Username, lookupErr)
	}
}

err := CheckPerms(pluginPath)
if err != nil {
	if strings.Contains(err.Error(), "looking up current user sid") {
		log.Warnf("SID lookup failed (domain account offline?): %v", err)
	}
	return err
}

When it happens

Trigger: Calling CheckPerms when windows.LookupSID cannot resolve currentUser.Username — e.g. the account name is in a format LookupSid can't resolve against the local system, the account was deleted/renamed after the process started, or the account is a domain account and the domain controller is unreachable while no local resolution exists.

Common situations: Running crowdsec under a domain service account while disconnected from the domain; running as a virtual/machine account (gMSA) whose name doesn't resolve via LookupAccountName; unusual username formats (UPN vs SAM name) returned by user.Current().

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

• while creating SYSTEM well known sid: %w
• while creating built-in Administrators well known sid: %w
• security descriptor is invalid
• owner is invalid
• while getting current user: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/94de3a613c00c9c8. Report an issue: GitHub.