peass-ng/PEASS-ng · error · Win32Exception

{0}: OpenProcessToken failed with error: {1}

Error message

{0}: OpenProcessToken failed with error: {1}

What it means

GetProcessElevationType throws Win32Exception when the native OpenProcessToken call on the current process fails; the message embeds the method name and the Win32 error code ('{0}: OpenProcessToken failed with error: {1}'). This is used by IsElevatedProcess to determine if the process is elevated. Failure means the process token could not be opened with TOKEN_READ.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/AlphaFS/Security/ProcessContext.cs:130

            throw new InvalidOperationException(Resources.GetCurrentWindowsIdentityFailed);

         return new WindowsPrincipal(windowsIdentity);
      }


      /// <summary>[AlphaFS] Retrieves the elevation type of the current process.</summary>
      /// <returns>A <see cref="NativeMethods.TOKEN_ELEVATION_TYPE"/> value.</returns>
      [SuppressMessage("Microsoft.Naming", "CA2204:Literals should be spelled correctly", MessageId = "GetTokenInformation")]
      [SuppressMessage("Microsoft.Naming", "CA2204:Literals should be spelled correctly", MessageId = "OpenProcessToken")]
      private static NativeMethods.TOKEN_ELEVATION_TYPE GetProcessElevationType()
      {
         SafeTokenHandle tokenHandle;

         var success = NativeMethods.OpenProcessToken(Process.GetCurrentProcess().Handle, NativeMethods.TOKEN.TOKEN_READ, out tokenHandle);

         var lastError = Marshal.GetLastWin32Error();
         if (!success)
            throw new Win32Exception(lastError, string.Format(CultureInfo.CurrentCulture, "{0}: OpenProcessToken failed with error: {1}", MethodBase.GetCurrentMethod().Name, lastError.ToString(CultureInfo.CurrentCulture)));


         using (tokenHandle)
         using (var safeBuffer = new SafeGlobalMemoryBufferHandle(Marshal.SizeOf(Enum.GetUnderlyingType(typeof(NativeMethods.TOKEN_ELEVATION_TYPE)))))
         {
            uint bytesReturned;
            success = NativeMethods.GetTokenInformation(tokenHandle, NativeMethods.TOKEN_INFORMATION_CLASS.TokenElevationType, safeBuffer, (uint) safeBuffer.Capacity, out bytesReturned);

            lastError = Marshal.GetLastWin32Error();

            if (!success)
               throw new Win32Exception(lastError, string.Format(CultureInfo.CurrentCulture, "{0}: GetTokenInformation failed with error: {1}", MethodBase.GetCurrentMethod().Name, lastError.ToString(CultureInfo.CurrentCulture)));


            return (NativeMethods.TOKEN_ELEVATION_TYPE) safeBuffer.ReadInt32();
         }
      }
   }

View on GitHub (pinned to 53fb989abc)

Solutions

1. Inspect the embedded Win32 error code in the message (e.g. ERROR_ACCESS_DENIED) and address that condition
2. Run the check from a context with standard token access; avoid calling inside heavily restricted sandboxes
3. Fallback: check elevation via WindowsIdentity.GetCurrent().Owner vs Administrators SID or env-var comparison instead of OpenProcessToken
4. Catch Win32Exception around IsElevatedProcess and treat elevation as unknown

Example fix

// before
bool elevated = ProcessContext.IsElevatedProcess();
// after
bool elevated;
try { elevated = ProcessContext.IsElevatedProcess(); }
catch (Win32Exception ex) { Log("elevation check failed: " + ex.Message); elevated = false; }

// best-effort precheck is not possible; treat as environment check
bool canReadToken = true; // OpenProcessToken failure only detectable at call time

try { bool elev = ProcessContext.IsElevatedProcess(); }
catch (Win32Exception ex) { Log($"elevation unknown: {ex.NativeErrorCode}"); elev = false; }

When it happens

Trigger: Calling ProcessContext.IsElevatedProcess when OpenProcessToken fails — e.g. restricted token, hardened process mitigation policies, or sandbox limiting token access rights.

Common situations: Running inside a highly restricted job/appcontainer, antivirus sandboxing, or CI environments where TOKEN_READ on the own process handle is denied; corrupted or limited primary tokens.

Related errors

• {0}: GetTokenInformation failed with error: {1}
• GetCurrentWindowsIdentityFailed
• Security descriptor mismatch between specified credentials a

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/6981d9b5f962441e. Report an issue: GitHub.