elastic/elasticsearch · error · UnsupportedOperationException

QueryInformationJobObject: {}

Error message

QueryInformationJobObject: {}

What it means

Thrown as UnsupportedOperationException when kernel32.QueryInformationJobObject() returns false after the job object was successfully created. The message includes GetLastError(). This means the job handle is valid but the system refused to read its current limits, which can happen with permission restrictions or handle access mask mismatches.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/WindowsNativeAccess.java:167

     * Process creation is restricted with {@code SetInformationJobObject/ActiveProcessLimit}.
     * <p>
     * Note: This is not intended as a real sandbox. It is another level of security, mostly intended to annoy
     * security researchers and make their lives more difficult in achieving "remote execution" exploits.
     */
    @Override
    public void tryInstallExecSandbox() {
        // create a new Job
        Handle job = kernel.CreateJobObjectW();
        if (job == null) {
            throw new UnsupportedOperationException("CreateJobObject: " + kernel.GetLastError());
        }

        try {
            // retrieve the current basic limits of the job
            int clazz = JOBOBJECT_BASIC_LIMIT_INFORMATION_CLASS;
            var info = kernel.newJobObjectBasicLimitInformation();
            if (kernel.QueryInformationJobObject(job, clazz, info) == false) {
                throw new UnsupportedOperationException("QueryInformationJobObject: " + kernel.GetLastError());
            }
            // modify the number of active processes to be 1 (exactly the one process we will add to the job).
            info.setActiveProcessLimit(1);
            info.setLimitFlags(JOB_OBJECT_LIMIT_ACTIVE_PROCESS);
            if (kernel.SetInformationJobObject(job, clazz, info) == false) {
                throw new UnsupportedOperationException("SetInformationJobObject: " + kernel.GetLastError());
            }
            // assign ourselves to the job
            if (kernel.AssignProcessToJobObject(job, kernel.GetCurrentProcess()) == false) {
                throw new UnsupportedOperationException("AssignProcessToJobObject: " + kernel.GetLastError());
            }
        } finally {
            kernel.CloseHandle(job);
        }

        execSandboxState = ExecSandboxState.ALL_THREADS;
        logger.debug("Windows ActiveProcessLimit initialization successful");
    }

View on GitHub (pinned to db6a809a66)

Solutions

  1. Decode the GetLastError() code with 'net helpmsg <code>'.
  2. Ensure the service account has the right to query job object information.
  3. If this persists, the exec sandbox cannot be installed; catch the exception and continue without it.
  4. Check if another security product (antivirus, EDR) is interfering with job object queries.

Example fix

// before
windowsNativeAccess.tryInstallExecSandbox();

// after
try {
    windowsNativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("Could not query Windows job object limits; exec sandbox not installed", e);
}
Defensive patterns

Strategy: try-catch

Validate before calling

// No pre-check available for QueryInformationJobObject; use try-catch.
// Verify the account has job-object query rights via Windows security policy.

Try / catch

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    logger.warn("QueryInformationJobObject failed; exec sandbox unavailable", e);
}

Prevention

When it happens

Trigger: Calling tryInstallExecSandbox() where QueryInformationJobObject(job, JOBOBJECT_BASIC_LIMIT_INFORMATION, info) fails. The job was created (CreateJobObjectW succeeded) but querying its limits is denied.

Common situations: The job object's default security descriptor denies the calling token QUERY access. Running under a low-privilege account. Windows version-specific ACL behavior on job objects. Rare kernel bug.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/12987abdf2dc8c07. Report an issue: GitHub.