go-delve/delve · error

could not acquire debug privilege (AdjustTokenPrivileges): %

Error message

could not acquire debug privilege (AdjustTokenPrivileges): %v

What it means

Final step of acquireDebugPrivilege: Delve calls AdjustTokenPrivileges to turn on SeDebugPrivilege for its token. If that Win32 call fails (returns 0), this error wraps the reason. Note: AdjustTokenPrivileges can also succeed while not actually granting the privilege (GetLastError() == ERROR_NOT_ALL_ASSIGNED); this error only fires when the call itself fails.

Source

Thrown at pkg/proc/native/proc_windows.go:217

		return fmt.Errorf("could not acquire debug privilege (OpenCurrentProcessToken): %v", err)
	}
	defer token.Close()

	privName, _ := sys.UTF16FromString("SeDebugPrivilege")
	var luid sys.LUID
	err = sys.LookupPrivilegeValue(nil, &privName[0], &luid)
	if err != nil {
		return fmt.Errorf("could not acquire debug privilege  (LookupPrivilegeValue): %v", err)
	}

	var tp sys.Tokenprivileges
	tp.PrivilegeCount = 1
	tp.Privileges[0].Luid = luid
	tp.Privileges[0].Attributes = sys.SE_PRIVILEGE_ENABLED

	err = sys.AdjustTokenPrivileges(token, false, &tp, 0, nil, nil)
	if err != nil {
		return fmt.Errorf("could not acquire debug privilege (AdjustTokenPrivileges): %v", err)
	}

	return nil
}

func waitForSearchProcess(pfx string, seen map[int]struct{}) (int, error) {
	log := logflags.DebuggerLogger()
	handle, err := sys.CreateToolhelp32Snapshot(sys.TH32CS_SNAPPROCESS, 0)
	if err != nil {
		return 0, fmt.Errorf("could not get process list: %v", err)
	}
	defer sys.CloseHandle(handle)

	var entry sys.ProcessEntry32
	entry.Size = uint32(unsafe.Sizeof(entry))
	err = sys.Process32First(handle, &entry)
	if err != nil {
		return 0, fmt.Errorf("could not get process list: %v", err)

View on GitHub (pinned to a23773e6c3)

Solutions

1. Relaunch Delve elevated (Right-click -> Run as administrator) — most common fix.
2. Confirm the privilege is actually assigned: `whoami /priv` shows SeDebugPrivilege only when enabled.
3. If Delve still cannot enable it, attach to the process as the same user that owns it, avoiding the need for SeDebugPrivilege.
4. Check EDR/AV software that may block debugger token manipulation.

Example fix

// before
c:> dlv attach 4242
// could not acquire debug privilege (AdjustTokenPrivileges): ...
// after
c:> # start an elevated shell first
start-process powershell -verb runas
c(dlv attach 4242)

// powershell: confirm SeDebugPrivilege is enabled for the current token
whoami /priv | Select-String "SeDebugPrivilege\s+Enabled"

if err := dbg.Attach(pid, nil); err != nil {
    if strings.Contains(err.Error(), "AdjustTokenPrivileges") {
        // relaunch elevated, or attach as the process owner
    }
}

When it happens

Trigger: Attach on Windows where AdjustTokenPrivileges returns failure — invalid token handle, invalid privilege LUID, or token was closed/changed between calls.

Common situations: Attaching from a non-elevated shell where the privilege is present in the list but not enabled and the call fails; token invalidated by session changes; UAC-restricted tokens in odd launch contexts.

Related errors

• could not acquire debug privilege (OpenCurrentProcessToken):
• could not acquire debug privilege (LookupPrivilegeValue): %
• %v also %v
• could not get process list: %v
• lldb backend not supported on Windows

AI-assisted analysis of go-delve/delve@a23773e6c3 (2026-08-31). Data as JSON: /api/errors/5c44efb778f4b177. Report an issue: GitHub.