not running as member of BUILTIN\Administrators group

Error message

not running as member of BUILTIN\Administrators group

What it means

Windows build of IsPrivileged: it allocates the BUILTIN\Administrators SID, opens the current process token (windows.Token(0)) and calls IsMember. If the membership query succeeds but returns false — the token does not carry the Administrators group — this error is returned. A failed query itself produces the distinct 'failed to check group membership' error.

Source

Thrown at pkg/util/permissions/permissions_windows.go:40

		windows.SECURITY_BUILTIN_DOMAIN_RID,
		windows.DOMAIN_ALIAS_RID_ADMINS,
		0, 0, 0, 0, 0, 0,
		&sid)
	if err != nil {
		return errors.WithMessage(err, "failed to create Windows SID")
	}
	defer windows.FreeSid(sid)

	// Ref: https://github.com/golang/go/issues/28804#issuecomment-438838144
	token := windows.Token(0)

	member, err := token.IsMember(sid)
	if err != nil {
		return errors.WithMessage(err, "failed to check group membership")
	}

	if !member {
		return errors.New("not running as member of BUILTIN\\Administrators group")
	}

	return nil
}

View on GitHub (pinned to 6ba341e396)

Solutions

Run the process elevated: right-click 'Run as administrator' or Start-Process -Verb RunAs
Configure the Windows service or scheduled task under an Administrators account with highest privileges
If the error is 'failed to check group membership' instead, fix the token/SID query failure first

Defensive patterns

Strategy: validation

Validate before calling

t := windows.Token(0)
sid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
if err == nil {
    if m, _ := t.IsMember(sid); !m {
        log.Fatal("restart from an elevated (administrator) shell")
    }
}

Try / catch

if err := permissions.IsPrivileged(); err != nil {
    if strings.Contains(err.Error(), "BUILTIN\\Administrators") {
        // privilege problem: re-run elevated rather than continuing degraded
        log.Fatal("must run as administrator")
    }
}

Prevention

Install Windows services under an Administrators account with 'run with highest privileges'
Document elevation requirements in setup scripts so operators do not hit this at runtime
Distinguish this error from 'failed to check group membership' — that one is a token query failure, not a privilege gap

When it happens

Trigger: Calling permissions.IsPrivileged() on Windows from a non-elevated process or an account not in BUILTIN\Administrators; a UAC-filtered token without elevation also counts.

Common situations: Running in a plain (non-'Run as administrator') PowerShell/RDP session; a Windows service configured under a standard account; scheduled tasks without 'run with highest privileges'.

Related errors

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/44affdf4ca4a20b2. Report an issue: GitHub.