Change:
package app import ( <del> "fmt" </del> <ins> "errors" </ins> "os/user" "golang.org/x/sys/windows" <ins> "k8s.io/klog/v2" </ins> ) <del> func isAdmin() (bool, error) { // Get current user u, err := user.Current() if err != nil { return false, fmt.Errorf("error retrieving current user: %s", err) } // Get IDs of group user is a member of ids, err := u.GroupIds() if err != nil { return false, fmt.Errorf("error retrieving group ids: %s", err) } // Check for existence of BUILTINADMINISTRATORS group id for i := range ids { // BUILTINADMINISTRATORS if "S-1-5-32-544" == ids[i] { return true, nil } } return false, nil } </del> func checkPermissions() error { <del> //https://github.com/golang/go/issues/28804#issuecomment-505326268 var sid *windows.SID var userIsAdmin bool // https://docs.microsoft.com/en-us/windows/desktop/api/securitybaseapi/nf-securitybaseapi-checktokenmembership err := windows.AllocateAndInitializeSid( &windows.SECURITY_NT_AUTHORITY, 2, windows.SECURITY_BUILTIN_DOMAIN_RID, windows.DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &sid) </del> <ins> u, err := user.Current() </ins> if err != nil { <del> return fmt.Errorf("error while checking for elevated permissions: %s", err) </del> <ins> klog.ErrorS(err, "Unable to get current user") return err </ins> } <del> //We must free the sid to prevent security token leaks defer windows.FreeSid(sid) token := windows.Token(0) </del> <ins> // For Windows user.UserName contains the login name and user.Name contains // the user's display name - https://pkg.go.dev/os/user#User klog.InfoS("Kubelet is running as", "login name", u.Username, "dispaly name", u.Name) </ins> <del> userIsAdmin, err = isAdmin() if err != nil { return fmt.Errorf("error while checking admin group membership: %s", err) } member, err := token.IsMember(sid) if err != nil { return fmt.Errorf("error while checking for elevated permissions: %s", err) } if !member { return fmt.Errorf("kubelet needs to run with administrator permissions. Run as admin is: %t, User in admin group: %t", member, userIsAdmin) </del> <ins> if !windows.GetCurrentProcessToken().IsElevated() { return errors.New("kubelet needs to run with elevated permissions!") </ins> } return nil

Discussion:
If kubelet is configured to run as a service using the service account check to verify the kubelet is running with elevated privileges fails with the follow error message Running the kubelet as a Windows serrvier using should not report kubelet is running with insufficient permissions. On a windows node run as a service using the account. This logic checks to see if the currently running user is in the group. This is the correct logic if kubelet is running as a user account but does not work correctly when running as one of the built-in service accounts (Local System, Network Service, or Local Service). Here the call to get the group Ids for a given user is failing because saying that the specified username does not exist. <details</details<details</details<details</details<details</details<details</details<details</details
/sig windows node /area kubelet Related to
I think we can probably just and check to see if token.IsElevated is true. This does not account for the case where kubelet is not running elevated but is running with an account that could elevate but I don't think we care about that (because we'd need to relaunch kubelet as elevated). I think we just need to check/ensure the current process is running running as elevated...
please triage this /remove-sig node since it's pure windows issue
/triage accepted The current behavior does not work for some common scenarios. I've got a PR open for a fix () that does need node reviews. Thanks!