crowdsecurity/crowdsec · error

while setting token information: %w

Error message

while setting token information: %w

What it means

This error wraps a failure from windows.SetTokenInformation, which sets the duplicated token's integrity level to Medium (via a Tokenmandatorylabel with the WinMediumLabelSid) so the plugin runs as a medium-integrity process that can still communicate with crowdsec over the local TCP socket. It is thrown when the OS rejects the TokenIntegrityLevel update, typically because the token lacks TOKEN_ADJUST_DEFAULT access.

Source

Thrown at pkg/csplugin/utils_windows.go:200

		return nil, fmt.Errorf("while adjusting token privileges: %w", err)
	}

	//Run the plugin as a medium integrity level process
	//For some reasons, low level integrity don't work, the plugin and crowdsec cannot communicate over the TCP socket
	sid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinMediumLabelSid))
	if err != nil {
		return nil, err
	}

	tml := &windows.Tokenmandatorylabel{}
	tml.Label.Attributes = windows.SE_GROUP_INTEGRITY
	tml.Label.Sid = sid

	err = windows.SetTokenInformation(token, windows.TokenIntegrityLevel,
		(*byte)(unsafe.Pointer(tml)), tml.Size())
	if err != nil {
		token.Close()
		return nil, fmt.Errorf("while setting token information: %w", err)
	}

	return &windows.SysProcAttr{
		CreationFlags: windows.CREATE_NEW_PROCESS_GROUP,
		Token:         syscall.Token(token),
	}, nil
}

func (*PluginBroker) CreateCmd(ctx context.Context, binaryPath string) (*exec.Cmd, error) {
	var err error
	cmd := exec.CommandContext(ctx, binaryPath)
	cmd.SysProcAttr, err = getProcessAttr()
	if err != nil {
		return nil, fmt.Errorf("while getting process attributes: %w", err)
	}
	return cmd, err
}

View on GitHub (pinned to 909b515798)

Solutions

1. Pass windows.TOKEN_ADJUST_DEFAULT (plus TOKEN_DUPLICATE|TOKEN_QUERY|TOKEN_ASSIGN_PRIMARY) as the desiredAccess argument to DuplicateTokenEx instead of 0.
2. Log the wrapped syscall.Errno to distinguish ERROR_ACCESS_DENIED from ERROR_INVALID_PARAMETER.
3. Verify the Tokenmandatorylabel struct and the medium-integrity SID are correctly built (SE_GROUP_INTEGRITY attribute set).
4. Check EDR/policy interference and whitelist the crowdsec binary for token operations.

Example fix

// before
err = windows.DuplicateTokenEx(procToken, 0, nil, windows.SecurityImpersonation, windows.TokenPrimary, &token)
// after
err = windows.DuplicateTokenEx(procToken, windows.TOKEN_ADJUST_DEFAULT|windows.TOKEN_ADJUST_GROUPS|windows.TOKEN_QUERY|windows.TOKEN_ASSIGN_PRIMARY, nil, windows.SecurityImpersonation, windows.TokenPrimary, &token)

// Request TOKEN_ADJUST_DEFAULT when duplicating so integrity level can be set
err := windows.DuplicateTokenEx(procToken,
    windows.TOKEN_ADJUST_DEFAULT|windows.TOKEN_QUERY|windows.TOKEN_ASSIGN_PRIMARY|windows.TOKEN_DUPLICATE,
    nil, windows.SecurityImpersonation, windows.TokenPrimary, &token)

cmd, err := broker.CreateCmd(ctx, binaryPath)
if err != nil {
    var errno syscall.Errno
    if errors.As(err, &errno) {
        if errno == windows.ERROR_ACCESS_DENIED {
            log.Error("cannot set token integrity level: token lacks TOKEN_ADJUST_DEFAULT")
        }
    }
    return err
}

When it happens

Trigger: getProcessAttr, called from PluginBroker.CreateCmd on Windows, fails at SetTokenInformation(token, TokenIntegrityLevel, tml, tml.Size()) — e.g. the duplicated token was created without TOKEN_ADJUST_DEFAULT in its desired access (DuplicateTokenEx is called with desiredAccess=0 here, which can be denied), or the mandatory label structure/SID is invalid.

Common situations: OS hardening or EDR blocking integrity-level assignment; a Windows update changing token policy; calling code that changed the DuplicateTokenEx desiredAccess mask and lost TOKEN_ADJUST_DEFAULT; invalid Tokenmandatorylabel construction after a struct change.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• while adjusting token privileges: %w
• while getting process attributes: %w
• invalid log level
• event_channel and xpath_query are mutually exclusive
• event_channel or xpath_query must be set

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/d0f237ffb74f8c84. Report an issue: GitHub.