could not acquire debug privilege (LookupPrivilegeValue): %

Error message

could not acquire debug privilege  (LookupPrivilegeValue): %v

What it means

Second step of acquireDebugPrivilege: after opening the process token, Delve resolves the privilege name "SeDebugPrivilege" to its LUID using LookupPrivilegeValue. Failure means the privilege name could not be resolved on this system, wrapped in this error (note the double space in the message distinguishes it from the OpenProcessToken variant).

Source

Thrown at pkg/proc/native/proc_windows.go:207

// acquireDebugPrivilege acquires the debug privilege which is needed to
// debug other user's processes.
// See:
//
//   - https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debug-privilege
//   - https://github.com/go-delve/delve/issues/3136
func acquireDebugPrivilege() error {
	var token sys.Token
	err := sys.OpenProcessToken(sys.CurrentProcess(), sys.TOKEN_QUERY|sys.TOKEN_ADJUST_PRIVILEGES, &token)
	if err != nil {
		return fmt.Errorf("could not acquire debug privilege (OpenCurrentProcessToken): %v", err)
	}
	defer token.Close()

	privName, _ := sys.UTF16FromString("SeDebugPrivilege")
	var luid sys.LUID
	err = sys.LookupPrivilegeValue(nil, &privName[0], &luid)
	if err != nil {
		return fmt.Errorf("could not acquire debug privilege  (LookupPrivilegeValue): %v", err)
	}

	var tp sys.Tokenprivileges
	tp.PrivilegeCount = 1
	tp.Privileges[0].Luid = luid
	tp.Privileges[0].Attributes = sys.SE_PRIVILEGE_ENABLED

	err = sys.AdjustTokenPrivileges(token, false, &tp, 0, nil, nil)
	if err != nil {
		return fmt.Errorf("could not acquire debug privilege (AdjustTokenPrivileges): %v", err)
	}

	return nil
}

func waitForSearchProcess(pfx string, seen map[int]struct{}) (int, error) {
	log := logflags.DebuggerLogger()
	handle, err := sys.CreateToolhelp32Snapshot(sys.TH32CS_SNAPPROCESS, 0)

View on GitHub (pinned to a23773e6c3)

Solutions

Verify SeDebugPrivilege exists: `whoami /priv | findstr SeDebugPrivilege`.
Run on a standard Windows client/server SKU; check for security baseline GPOs that remove debugger privileges.
Run elevated as Administrator and retry.
Check the underlying Win32 error in %v (e.g. ERROR_NO_SUCH_PRIVILEGE) and address that specific condition.

Example fix

// before
c:> dlv attach 4242
// could not acquire debug privilege  (LookupPrivilegeValue): ...
// after
c:> whoami /priv | findstr SeDebugPrivilege
c:> # if absent, run elevated or restore the privilege via secpol.msc
//   Local Security Policy -> User Rights Assignment -> Debug programs

Defensive patterns

Strategy: validation

Validate before calling

// powershell: verify the privilege is assigned before attach
$priv = whoami /priv | Select-String SeDebugPrivilege
if (-not $priv) { Write-Error "SeDebugPrivilege missing; run elevated or via secpol.msc" }

Try / catch

if err := dbg.Attach(pid, nil); err != nil {
    if strings.Contains(err.Error(), "LookupPrivilegeValue") {
        // restore "Debug programs" user right, then retry elevated
    }
}

Prevention

Keep the default "Debug programs" user right intact in security policy.
Run on standard Windows SKUs without stripped privilege metadata.
Always run elevated when attaching cross-user.

When it happens

Trigger: Attach on Windows where LookupPrivilegeValue(nil, "SeDebugPrivilege", &luid) returns FALSE — rare, typically system-level policy or token issues.

Common situations: Hardened/modified Windows images where privilege lookup is restricted; domain policy stripping privilege metadata; running on non-standard Windows variants (e.g. stripped IoT/SKU builds).

Related errors

AI-assisted analysis of go-delve/delve@a23773e6c3 (2026-08-31). Data as JSON: /api/errors/2ad2c5636bcca651. Report an issue: GitHub.