What causes "Failed to open process token, error {}" in rustdesk/rustdesk?

Elevate the caller (admin) before querying other users'/SYSTEM processes' tokens

Failed to open process token, error {}

Error message

Failed to open process token, error {}

What it means

`OpenProcessToken(handle, TOKEN_QUERY, &mut token)` returned FALSE, so no query handle to the process's primary token could be obtained; the Win32 last error is included. The process handle was opened successfully, but the token request itself was denied or invalid.

Source

Thrown at src/platform/windows.rs:2499

}

pub fn is_elevated(process_id: Option<DWORD>) -> ResultType<bool> {
    use base::platform::windows::RAIIHandle;
    unsafe {
        let handle: HANDLE = match process_id {
            Some(process_id) => OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, process_id),
            None => GetCurrentProcess(),
        };
        if handle == NULL {
            bail!(
                "Failed to open process, error {}",
                io::Error::last_os_error()
            )
        }
        let _handle = RAIIHandle(handle);
        let mut token: HANDLE = mem::zeroed();
        if OpenProcessToken(handle, TOKEN_QUERY, &mut token) == FALSE {
            bail!(
                "Failed to open process token, error {}",
                io::Error::last_os_error()
            )
        }
        let _token = RAIIHandle(token);
        let mut token_elevation: TOKEN_ELEVATION = mem::zeroed();
        let mut size: DWORD = 0;
        if GetTokenInformation(
            token,
            TokenElevation,
            (&mut token_elevation) as *mut _ as *mut c_void,
            mem::size_of::<TOKEN_ELEVATION>() as _,
            &mut size,
        ) == FALSE
        {
            bail!(
                "Failed to get token information, error {}",
                io::Error::last_os_error()

View on GitHub (pinned to 91c9fccbb0)

Solutions

Elevate the caller (admin) before querying other users'/SYSTEM processes' tokens
Request the process handle with the access rights that include token query (`PROCESS_QUERY_LIMITED_INFORMATION` is already minimal — consider `PROCESS_QUERY_INFORMATION` if policy allows)
Re-acquire the PID and retry if the process may have terminated mid-check
If the target belongs to another session, run the check within that session's context (e.g. from the service)

Defensive patterns

Strategy: try-catch

Try / catch

if OpenProcessToken(handle, TOKEN_QUERY, &mut token) == 0 {
    let err = io::Error::last_os_error();
    if err.raw_os_error() == Some(5) { /* elevate and retry */ }
    return Err(err.into());
}

Prevention

Query only tokens of processes at or below your integrity level
Keep the process handle open until the token query completes
Run token inspections from the service (SYSTEM) context when targeting other sessions

When it happens

Trigger: The elevation-check helper (src/platform/windows.rs:2499) after a successful `OpenProcess`: fails when the caller lacks TOKEN_QUERY rights on the target token (target at higher integrity), the handle lacks required access, or the target is a protected process.

Common situations: Standard-user process querying a SYSTEM service's token, security software stripping token access, or querying a process that exited between OpenProcess and OpenProcessToken.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of rustdesk/rustdesk@91c9fccbb0 (2026-09-10). Data as JSON: /api/errors/2c1a353ef981e599. Report an issue: GitHub.