peass-ng/PEASS-ng · warning · Win32Exception

{0}: GetTokenInformation failed with error: {1}

Error message

{0}: GetTokenInformation failed with error: {1}

What it means

GetProcessElevationType calls the Win32 API GetTokenInformation to query TokenElevationType for the current process token. When the API call fails, it throws a Win32Exception wrapping the last Win32 error code, indicating the elevation type could not be determined. This is a defensive wrapper around a native call that fails only when the token handle or buffer is invalid.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/AlphaFS/Security/ProcessContext.cs:142

         SafeTokenHandle tokenHandle;

         var success = NativeMethods.OpenProcessToken(Process.GetCurrentProcess().Handle, NativeMethods.TOKEN.TOKEN_READ, out tokenHandle);

         var lastError = Marshal.GetLastWin32Error();
         if (!success)
            throw new Win32Exception(lastError, string.Format(CultureInfo.CurrentCulture, "{0}: OpenProcessToken failed with error: {1}", MethodBase.GetCurrentMethod().Name, lastError.ToString(CultureInfo.CurrentCulture)));


         using (tokenHandle)
         using (var safeBuffer = new SafeGlobalMemoryBufferHandle(Marshal.SizeOf(Enum.GetUnderlyingType(typeof(NativeMethods.TOKEN_ELEVATION_TYPE)))))
         {
            uint bytesReturned;
            success = NativeMethods.GetTokenInformation(tokenHandle, NativeMethods.TOKEN_INFORMATION_CLASS.TokenElevationType, safeBuffer, (uint) safeBuffer.Capacity, out bytesReturned);

            lastError = Marshal.GetLastWin32Error();

            if (!success)
               throw new Win32Exception(lastError, string.Format(CultureInfo.CurrentCulture, "{0}: GetTokenInformation failed with error: {1}", MethodBase.GetCurrentMethod().Name, lastError.ToString(CultureInfo.CurrentCulture)));


            return (NativeMethods.TOKEN_ELEVATION_TYPE) safeBuffer.ReadInt32();
         }
      }
   }
}

View on GitHub (pinned to 53fb989abc)

Solutions

1. Ensure the token handle was obtained successfully via OpenProcessToken/OpenThreadToken with TOKEN_QUERY access before calling GetProcessElevationType.
2. Verify safeBuffer.Capacity is at least 4 bytes (size of TOKEN_ELEVATION_TYPE) and the buffer is not disposed.
3. Wrap the call in try-catch and treat failure as 'elevation unknown' rather than crashing the enumeration.
4. Run the process with sufficient privileges or check IsElevatedProcess via alternative means (e.g. WindowsIdentity) if token queries are blocked.

Example fix

// before
bool elevated = IsElevatedProcess();
// after
bool elevated;
try { elevated = IsElevatedProcess(); }
catch (Win32Exception) { elevated = false; } // elevation unknown, assume not elevated

// check token validity before querying
if (tokenHandle == null || tokenHandle.IsInvalid || tokenHandle.IsClosed)
    throw new InvalidOperationException("No valid process token handle");
// buffer must hold a uint (4 bytes)
if (safeBuffer == null || safeBuffer.Capacity < sizeof(uint))
    throw new ArgumentException("Buffer too small for TOKEN_ELEVATION_TYPE");

static bool IsValidToken(SafeTokenHandle h) => h != null && !h.IsInvalid && !h.IsClosed;

bool elevated;
try {
    elevated = IsElevatedProcess();
} catch (Win32Exception ex) {
    // ex.NativeErrorCode holds the Win32 error
    Log.Warn("Elevation query failed: " + ex.NativeErrorCode);
    elevated = false; // graceful degradation
}

When it happens

Trigger: GetTokenInformation returns false, typically because tokenHandle is invalid or closed, safeBuffer has insufficient Capacity for TOKEN_ELEVATION_TYPE, or the token was opened with insufficient access rights (TOKEN_QUERY missing).

Common situations: Running in restricted environments (service contexts, AppContainer, restricted job objects) where the process token cannot be queried; antivirus or host-hardening blocking token queries; corrupted handle reuse after token disposal.

Related errors

• {0}: OpenProcessToken failed with error: {1}
• volumeGuid
• Resources.Not_A_Valid_Guid
• volumeGuid
• Resources.Not_A_Valid_Guid

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/28dc44d6a44b65c2. Report an issue: GitHub.