go-delve/delve · error

could not acquire debug privilege (OpenCurrentProcessToken):

Error message

could not acquire debug privilege (OpenCurrentProcessToken): %v

What it means

acquireDebugPrivilege tries to enable SeDebugPrivilege on Delve's own process token so it can attach to processes it does not own. The first step opens the current process token with TOKEN_QUERY|TOKEN_ADJUST_PRIVILEGES via OpenProcessToken; if that Win32 call fails, this wrapped error is returned.

Source

Thrown at pkg/proc/native/proc_windows.go:199

	tgt, err := dbp.initialize(exepath, []string{})
	if err != nil {
		detachWithoutGroup(dbp, true)
		return nil, err
	}
	return tgt, nil
}

// acquireDebugPrivilege acquires the debug privilege which is needed to
// debug other user's processes.
// See:
//
//   - https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debug-privilege
//   - https://github.com/go-delve/delve/issues/3136
func acquireDebugPrivilege() error {
	var token sys.Token
	err := sys.OpenProcessToken(sys.CurrentProcess(), sys.TOKEN_QUERY|sys.TOKEN_ADJUST_PRIVILEGES, &token)
	if err != nil {
		return fmt.Errorf("could not acquire debug privilege (OpenCurrentProcessToken): %v", err)
	}
	defer token.Close()

	privName, _ := sys.UTF16FromString("SeDebugPrivilege")
	var luid sys.LUID
	err = sys.LookupPrivilegeValue(nil, &privName[0], &luid)
	if err != nil {
		return fmt.Errorf("could not acquire debug privilege  (LookupPrivilegeValue): %v", err)
	}

	var tp sys.Tokenprivileges
	tp.PrivilegeCount = 1
	tp.Privileges[0].Luid = luid
	tp.Privileges[0].Attributes = sys.SE_PRIVILEGE_ENABLED

	err = sys.AdjustTokenPrivileges(token, false, &tp, 0, nil, nil)
	if err != nil {
		return fmt.Errorf("could not acquire debug privilege (AdjustTokenPrivileges): %v", err)

View on GitHub (pinned to a23773e6c3)

Solutions

1. Run Delve from a normal elevated (Administrator) command prompt instead of a service/sandboxed context.
2. Check that the process token is accessible: `whoami /priv` should list privileges.
3. Verify no security policy (GPO/EDR) is blocking token access; consult `gpresult` or EDR logs.
4. If under AppContainer/jail, move execution outside the sandbox before attaching.

Example fix

// before (non-interactive service context)
c:> dlv attach 4242
// after
c:> runas /user:Administrator cmd
c:> whoami /priv   // confirm token works
c:> dlv attach 4242

// powershell: confirm the token is usable before debugging
whoami /priv | Select-String SeDebugPrivilege

if err := dbg.Attach(pid, nil); err != nil {
    if strings.Contains(err.Error(), "OpenCurrentProcessToken") {
        // token unavailable: rerun elevated / outside sandbox
    }
}

When it happens

Trigger: Calling Attach on Windows when OpenProcessToken fails — token handle exhaustion, restricted token, or the API returning an error such as ERROR_ACCESS_DENIED.

Common situations: Running Delve inside a heavily restricted service account or AppContainer/Sandbox; corrupted user profile/token; running from a non-interactive session without an accessible process token.

Related errors

• could not acquire debug privilege (LookupPrivilegeValue): %
• could not acquire debug privilege (AdjustTokenPrivileges): %
• %v also %v
• could not get process list: %v
• lldb backend not supported on Windows

AI-assisted analysis of go-delve/delve@a23773e6c3 (2026-08-31). Data as JSON: /api/errors/af3e81898653fb69. Report an issue: GitHub.