peass-ng/PEASS-ng · error · InvalidOperationException

GetCurrentWindowsIdentityFailed

Error message

GetCurrentWindowsIdentityFailed

What it means

GetWindowsPrincipal throws InvalidOperationException with the GetCurrentWindowsIdentityFailed resource string when WindowsIdentity.GetCurrent() returns null. The current thread's Windows identity could not be obtained, so no principal can be constructed. This indicates the process/thread is not running with a Windows identity attachable (e.g. unusual hosting or impersonation state).

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/AlphaFS/Security/ProcessContext.cs:112

         {
            WindowsIdentity windowsIdentity;
            var principal = GetWindowsPrincipal(out windowsIdentity);

            using (windowsIdentity)
               return principal.IsInRole(new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null)) ||
                      principal.IsInRole(new SecurityIdentifier(WellKnownSidType.ServiceSid, null));
         }
      }

      #endregion // Properties


      private static WindowsPrincipal GetWindowsPrincipal(out WindowsIdentity windowsIdentity)
      {
         windowsIdentity = WindowsIdentity.GetCurrent();

         if (null == windowsIdentity)
            throw new InvalidOperationException(Resources.GetCurrentWindowsIdentityFailed);

         return new WindowsPrincipal(windowsIdentity);
      }


      /// <summary>[AlphaFS] Retrieves the elevation type of the current process.</summary>
      /// <returns>A <see cref="NativeMethods.TOKEN_ELEVATION_TYPE"/> value.</returns>
      [SuppressMessage("Microsoft.Naming", "CA2204:Literals should be spelled correctly", MessageId = "GetTokenInformation")]
      [SuppressMessage("Microsoft.Naming", "CA2204:Literals should be spelled correctly", MessageId = "OpenProcessToken")]
      private static NativeMethods.TOKEN_ELEVATION_TYPE GetProcessElevationType()
      {
         SafeTokenHandle tokenHandle;

         var success = NativeMethods.OpenProcessToken(Process.GetCurrentProcess().Handle, NativeMethods.TOKEN.TOKEN_READ, out tokenHandle);

         var lastError = Marshal.GetLastWin32Error();
         if (!success)
            throw new Win32Exception(lastError, string.Format(CultureInfo.CurrentCulture, "{0}: OpenProcessToken failed with error: {1}", MethodBase.GetCurrentMethod().Name, lastError.ToString(CultureInfo.CurrentCulture)));

View on GitHub (pinned to 53fb989abc)

Solutions

1. Ensure the process runs under a real Windows account with a valid token
2. Check WindowsIdentity.GetCurrent() yourself before relying on principal and handle null
3. Avoid calling identity APIs from threads lacking a Windows identity; marshal the check to the main thread
4. Verify no code called WindowsIdentity.Impersonate/Undo in a way that left the thread anonymous

Example fix

// before
var principal = ProcessContext.principal;
// after
using (var id = WindowsIdentity.GetCurrent())
{
    if (id == null) { LogNoWindowsIdentity(); return; }
    var principal = new WindowsPrincipal(id);
}

var id = WindowsIdentity.GetCurrent();
if (id == null) { /* no Windows identity available; skip principal logic */ }

bool HasWindowsIdentity() { try { return WindowsIdentity.GetCurrent() != null; } catch (SecurityException) { return false; } }

try { var p = ProcessContext.principal; }
catch (InvalidOperationException ex) when (ex.Message == Resources.GetCurrentWindowsIdentityFailed || ex.Message.Contains("identity")) { Log("no Windows identity"); UseFallbackPrincipal(); }

When it happens

Trigger: Calling ProcessContext.principal (or anything reaching GetWindowsPrincipal) when WindowsIdentity.GetCurrent() returns null — typically no Windows identity on the thread or a corrupted/anonymous token context.

Common situations: Running inside a non-Windows-authenticated context (e.g. certain service accounts, thread pool threads without impersonation); hosting inside environments that strip the thread token; NUnit/CI agents with odd token setups.

Related errors

• {0}: OpenProcessToken failed with error: {1}
• Security descriptor mismatch between specified credentials a

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/e0ecbaf41fd4ce62. Report an issue: GitHub.