projectdiscovery/nuclei · error

lsa OpenPolicy2: %w

Error message

lsa OpenPolicy2: %w

What it means

lsa.OpenPolicy2() failed in LsaLookupSids: the server refused to open an LSA policy handle. SID lookup requires policy access that hardened configurations restrict to authenticated (sometimes admin) callers; anonymous/restricted tokens receive ACCESS_DENIED here. The bind and client init succeeded — this is policy-open authorization.

Source

Thrown at pkg/js/libs/dcerpc/dcerpc.go:485

// const r = c.LsaLookupSids(['S-1-5-21-...-500']);
// log(to_json(r));
// ```
func (c *Client) LsaLookupSids(sids []string) ([]LookupResult, error) {
	c.nj.Require(len(sids) > 0, "at least one SID must be provided")
	rpc, err := c.rpcOverNamedPipe("lsarpc", gplsa.UUID, gplsa.MajorVersion, gplsa.MinorVersion)
	if err != nil {
		return nil, err
	}
	defer func() {
		_ = rpc.Transport.Close()
	}()

	lsa, err := gplsa.NewLsaClient(rpc)
	if err != nil {
		return nil, fmt.Errorf("lsa init: %w", err)
	}
	if err := lsa.OpenPolicy2(); err != nil {
		return nil, fmt.Errorf("lsa OpenPolicy2: %w", err)
	}
	defer lsa.Close()
	return lsa.LookupSids(sids)
}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Use authenticated domain user credentials.
2. Verify the account holds 'Access this computer from the network' on the target.
3. Check anonymous-restriction hardening; retry as admin if present.
4. Confirm the SID list is well-formed so a later failure is not misread as this one.

Example fix

// before
const c = new dcerpc.Client('dc01', 'ACME', '', '');
c.LsaLookupSids(['S-1-5-32-544']); // lsa OpenPolicy2: ACCESS_DENIED

// after
const c = new dcerpc.Client('dc01', 'ACME', 'svc-scan', 'S3cure!pass');
c.LsaLookupSids(['S-1-5-32-544']);

try {
  const r = c.LsaLookupSids(sids);
} catch (e) {
  const msg = String(e);
  if (msg.includes('OpenPolicy2')) {
    // policy handle denied: insufficient rights or anonymous restriction
    log('LSA policy open denied: ' + msg);
  } else throw e;
}

When it happens

Trigger: LsaLookupSids() with null/guest creds, 'Restrict anonymous access to Named Pipes' style hardening, or a caller missing 'Access this computer from the network' rights.

Common situations: Anonymous enumeration defenses on DCs; service accounts stripped of logon rights; wrong domain again — policy open is domain-scoped.

Related errors

• lsa init: %w
• samr connect: %w
• smb connect: %w
• open pipe %q: %w
• dcerpc bind: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/aeb7c14560475b51. Report an issue: GitHub.