java-native-access/jna · error · IllegalArgumentException

Failed to find privilege "{privilege}" - {GetLastError}

Error message

Failed to find privilege "{privilege}" - {GetLastError}

What it means

Advapi32Util.Privilege's constructor resolves each privilege name (e.g. "SeDebugPrivilege") to a LUID via LookupPrivilegeValue. When the Windows API cannot find the privilege name, it returns false and the constructor throws IllegalArgumentException including the GetLastError code. This means the privilege name is not recognized on that system.

Source

Thrown at contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java:3246

        private boolean privilegesEnabled = false;

        /**
         * LUID form of the privileges
         */
        private final WinNT.LUID[] pLuids;

        /**
         * Construct and enable a set of privileges
         * @param privileges the names of the privileges in the form of SE_* from Advapi32.java
         * @throws IllegalArgumentException
         */
        public Privilege(String... privileges) throws IllegalArgumentException, Win32Exception {
            pLuids = new WinNT.LUID[privileges.length];
            int i = 0;
            for (String p : privileges) {
                pLuids[i] = new WinNT.LUID();
                if (!Advapi32.INSTANCE.LookupPrivilegeValue(null, p, pLuids[i])) {
                    throw new IllegalArgumentException("Failed to find privilege \"" + privileges[i] + "\" - " + Kernel32.INSTANCE.GetLastError());
                }
                i++;
            }
        }

        /**
         * Calls disable() to remove the privileges
         * @see java.io.Closeable#close()
         */
        @Override
        public void close() {
            this.disable();
        }

        /**
         * Enables the given privileges. If required, it will duplicate the process token. No resources are left open when this completes. That is, it is
         * NOT required to drop the privileges, although it is considered a best practice if you do not need it. This class is state full. It keeps track
         * of whether it has enabled the privileges. Multiple calls to enable() without a drop() in between have no affect.

View on GitHub (pinned to d036ad9781)

Solutions

  1. Check spelling against the documented privilege names (Se* constants in WinNT, e.g. "SeDebugPrivilege", "SeBackupPrivilege"); names are case-insensitive but must be exact otherwise.
  2. Use the named constants rather than string literals where available.
  3. Verify the privilege exists on the target OS edition; remove privileges not present on that Windows version.
  4. Catch IllegalArgumentException and log GetLastError to identify the specific failure (ERROR_NO_SUCH_PRIVilege=131).

Example fix

// before
Advapi32Util.Privilege p = new Advapi32Util.Privilege("SeDebugPrivilge");
// after
Advapi32Util.Privilege p = new Advapi32Util.Privilege("SeDebugPrivilege");
Defensive patterns

Strategy: validation

Validate before calling

boolean privilegeExists(String name) {
    WinNT.LUID luid = new WinNT.LUID();
    return Advapi32.INSTANCE.LookupPrivilegeValue(null, name, luid);
}
// call before constructing: if (!privilegeExists("SeDebugPrivilege")) throw ...

Try / catch

try {
    Advapi32Util.Privilege p = new Advapi32Util.Privilege("SeDebugPrivilege");
} catch (IllegalArgumentException e) {
    log.error("Unknown privilege: {}", e.getMessage());
}

Prevention

When it happens

Trigger: Passing a misspelled or nonexistent privilege name string (e.g. "SeDebugPrivilge") to new Advapi32Util.Privilege(...) or to APIs that build a Privilege; calling an elevation-requiring API with a privilege name that the target Windows version's local security database does not define.

Common situations: Typo in privilege constant name; hardcoding a privilege that only exists on certain Windows editions; running on a localized or stripped-down Windows image lacking the privilege; using the display (localized) name instead of the programmatic name.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of java-native-access/jna@d036ad9781 (2026-09-12). Data as JSON: /api/errors/59d58c551142ec65. Report an issue: GitHub.