projectdiscovery/nuclei · error

winstation OpenServer: %w

Error message

winstation OpenServer: %w

What it means

EnumProcesses binds the legacy WinStation API on the ctx_winstation pipe and legacy.OpenServer() failed: the terminal-services handle was refused. The Terminal Services service may not be running (Server Core, hardened builds), the caller lacks rights, or the legacy RPC surface is simply absent — this old API (nmap smb-enum-processes parity) is frequently unavailable on modern Windows.

Source

Thrown at pkg/js/libs/dcerpc/enum.go:155

//	}
//
// ```
func (c *Client) EnumProcesses() ([]ProcessEntry, error) {
	if !protocolstate.IsHostAllowed(c.nj.ExecutionId(), c.Host) {
		return nil, protocolstate.ErrHostDenied.Msgf(c.Host)
	}
	rpc, err := c.rpcOverNamedPipe(winstation.PipeCtxWinStation, winstation.LegacyAPIUUID, winstation.MajorVersion, winstation.MinorVersion)
	if err != nil {
		return nil, err
	}
	defer func() {
		_ = rpc.Transport.Close()
	}()

	legacy := winstation.NewLegacyClient(rpc)
	handle, err := legacy.OpenServer()
	if err != nil {
		return nil, fmt.Errorf("winstation OpenServer: %w", err)
	}
	defer func() {
		_ = legacy.CloseServer(handle)
	}()

	raw, err := legacy.GetAllProcesses(handle)
	if err != nil {
		return nil, err
	}
	return mapProcessEntries(raw), nil
}

// EnumLoggedOnUsers lists users currently known to the workstation service
// via WKSSVC NetrWkstaUserEnum. Complements SamrEnumerateUsers (domain DB)
// and EnumSessions (SMB sessions).
//
// @example
// ```javascript

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Verify the Terminal Services (termsrv) service is running on the target.
2. Use administrator credentials.
3. Prefer WMI Win32_Process enumeration via the nuclei wmi/goexec module — far more portable than the legacy WinStation API.
4. Confirm the pipe exists with RpcDump or a pipe listing before relying on this method.

Example fix

// before
c.EnumProcesses(); // winstation OpenServer: ...

// after (prefer the portable path)
try {
  log(to_json(c.EnumProcesses()));
} catch (e) {
  log('legacy WinStation API unavailable (' + e + '); use WMI Win32_Process instead');
}

try {
  const procs = c.EnumProcesses();
} catch (e) {
  const msg = String(e);
  if (msg.includes('winstation OpenServer')) {
    // legacy WinStation handle refused: service absent or rights missing
    log('WinStation API unavailable — prefer WMI Win32_Process: ' + msg);
  } else throw e;
}

When it happens

Trigger: EnumProcesses() on hosts without Terminal Services/RDS listening on the pipe, non-admin callers, or EDR blocking ctx_winstation opens.

Common situations: Servers with Terminal Services disabled; expectation from nmap-era tooling that the pipe always exists; EDR watching the pipe.

Related errors

• open pipe %q: %w
• samr connect: %w
• lsa init: %w
• svcctl open scm: %w
• encountered errors while performing template validation

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/cb5e78fa81b3bc97. Report an issue: GitHub.