crowdsecurity/crowdsec · error

while opening process token: %w

Error message

while opening process token: %w

What it means

This error wraps a failure from windows.OpenProcessToken, which opens the access token of the current crowdsec process so it can be duplicated and handed to the plugin subprocess. It is thrown when the OS refuses to open the process token with the requested access rights (TOKEN_DUPLICATE, TOKEN_QUERY, TOKEN_ASSIGN_PRIMARY, etc.), typically due to insufficient privileges on the process or a token/security-descriptor problem.

Source

Thrown at pkg/csplugin/utils_windows.go:167

		denyMask := ^(windows.FILE_GENERIC_READ | windows.FILE_GENERIC_EXECUTE)
		if ace.AccessMask&uint32(denyMask) != 0 {
			return fmt.Errorf("only SYSTEM, Administrators or the user currently running crowdsec can have more than read/execute on plugin %s", path)
		}
	}

	return nil
}

func getProcessAttr() (*windows.SysProcAttr, error) {
	var procToken, token windows.Token

	proc := windows.CurrentProcess()
	defer windows.CloseHandle(proc)

	err := windows.OpenProcessToken(proc, windows.TOKEN_DUPLICATE|windows.TOKEN_ADJUST_DEFAULT|
		windows.TOKEN_QUERY|windows.TOKEN_ASSIGN_PRIMARY|windows.TOKEN_ADJUST_GROUPS|windows.TOKEN_ADJUST_PRIVILEGES, &procToken)
	if err != nil {
		return nil, fmt.Errorf("while opening process token: %w", err)
	}
	defer procToken.Close()

	err = windows.DuplicateTokenEx(procToken, 0, nil, windows.SecurityImpersonation,
		windows.TokenPrimary, &token)
	if err != nil {
		return nil, fmt.Errorf("while duplicating token: %w", err)
	}

	//Remove all privileges from the token

	err = windows.AdjustTokenPrivileges(token, true, nil, 0, nil, nil)

	if err != nil {
		return nil, fmt.Errorf("while adjusting token privileges: %w", err)
	}

	//Run the plugin as a medium integrity level process

View on GitHub (pinned to 909b515798)

Solutions

1. Run crowdsec as a sufficiently privileged account (e.g. LocalSystem or a service account with SeAssignPrimaryTokenPrivilege / admin rights).
2. Check whether antivirus/EDR or AppLocker policy is blocking token operations and add an exclusion for the crowdsec binary.
3. Verify the process token is intact: log the underlying Win32 error from the wrapped %w to identify ERROR_ACCESS_DENIED vs other codes.
4. Upgrade/repair Windows if the process token is corrupted (rare); test with a minimal Go program calling OpenProcessToken with the same mask.

Example fix

// before
procTokenAccess := windows.TOKEN_DUPLICATE | windows.TOKEN_ADJUST_DEFAULT | windows.TOKEN_QUERY | windows.TOKEN_ASSIGN_PRIMARY | windows.TOKEN_ADJUST_GROUPS | windows.TOKEN_ADJUST_PRIVILEGES
err := windows.OpenProcessToken(proc, procTokenAccess, &procToken)
// after (narrow the mask and surface the underlying error for diagnosis)
procTokenAccess := windows.TOKEN_DUPLICATE | windows.TOKEN_QUERY | windows.TOKEN_ASSIGN_PRIMARY
if err := windows.OpenProcessToken(proc, procTokenAccess, &procToken); err != nil {
    return nil, fmt.Errorf("while opening process token: %w", err) // inspect wrapped syscall.Errno
}

if runtime.GOOS != "windows" {
    // token APIs not needed; skip
}
// Probe ability to open the process token before starting plugins
var tok windows.Token
if err := windows.OpenProcessToken(windows.CurrentProcess(), windows.TOKEN_QUERY, &tok); err != nil {
    log.Warnf("process token not openable, plugins may fail to start: %v", err)
}

cmd, err := broker.CreateCmd(ctx, binaryPath)
if err != nil {
    var errno syscall.Errno
    if errors.As(err, &errno) {
        switch errno {
        case windows.ERROR_ACCESS_DENIED:
            log.Error("insufficient privileges to open process token; run crowdsec as LocalSystem/admin")
        default:
            log.Errorf("token open failed: %v", err)
        }
    }
    return err
}

When it happens

Trigger: getProcessAttr, called from PluginBroker.CreateCmd when spawning a notification plugin on Windows, fails at OpenProcessToken — e.g. the process runs under an account whose token cannot be opened with the requested access mask, or a Win32 error such as ERROR_ACCESS_DENIED is returned by the syscall.

Common situations: Running crowdsec as a restricted service account or inside a sandboxed environment that strips token access rights; corrupted or restricted process token; third-party security software (AV/EDR) blocking token manipulation; running on a Windows variant where the calling process's DACL denies TOKEN_DUPLICATE.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• while duplicating token: %w
• invalid log level
• event_channel and xpath_query are mutually exclusive
• event_channel or xpath_query must be set
• empty wineventlog:// DSN

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/83bf4c423eb4a1cd. Report an issue: GitHub.