Pangolin Windows Client does not start correctly; the tray icon does not appear.

[p0se]

Describe the Bug

After successfully installing Pangolin 0.4.1 (pangolin-amd64-0.4.1.msi) on Windows 11, the application starts as a process or service, but does not display a GUI, tray icon, or visible user interface.
This behavior occurs when starting as a normal user as well as when starting as an administrator.

The MSI Installer Log does not report any errors.

The event log also does not provide any information.
Application Error X
.NET Runtime Error X
Crash log X

Pangolin works without any problems within the Sandbox function in Windows.

I imagine it has something to do with user rights.

I work as a user without admin rights, but I had to enter my admin password to install Pangolin. In the sandbox environment, I am permanently an admin.

Environment

• OS Type & Version: Windows 11 Pro (64 Bit)
• Client Version: 0.4.1

To Reproduce

Install pangolin as a normal user.
Try to start pangolin as a normal user or admin.

Expected Behavior

Start via Start menu or desktop

Display of a tray icon in the notification area

Option to log in via the tray menu

Local client runs visibly in the user context

[klisza1993]

Ive got the same issue. I had it on 0.4.0 and now on 0.5.0 is the same

[p0se]

I just tested it with the new version 0.5.0. The error is identical here.

[p0se]

I believe the following lines in windows-0.5.0/managers/service.go are causing the problem:

// Check if token is elevated
isAdmin := userToken.IsElevated()

// ...
if !isAdmin && !isOperator {
    userToken.Close()
    return
}

The manager service checks every logged-in session

and only starts the UI if:

the user is an administrator OR

an “operator” mode (not yet implemented) is active.

Normal users are strictly excluded.

One option could be:

}
		// Check if token is elevated
		isAdmin := userToken.IsElevated()
		// Also check if it can be elevated via UAC
		if !isAdmin {
			// Try to get linked token (UAC elevation token)
			linkedToken, err := userToken.GetLinkedToken()
			if err == nil {
				isAdmin = linkedToken.IsElevated()
				linkedToken.Close()
			}
		}
		// TODO: Implement LimitedOperatorUI support when config management is added
		// if !isAdmin && conf.AdminBool("LimitedOperatorUI") && operatorGroupSid != nil {
		// 	linkedToken, err := userToken.GetLinkedToken()
		// 	var impersonationToken windows.Token
		// 	if err == nil {
		// 		err = windows.DuplicateTokenEx(linkedToken, windows.TOKEN_QUERY, nil, windows.SecurityImpersonation, windows.TokenImpersonation, &impersonationToken)
		// 		linkedToken.Close()
		// 	} else {
		// 		err = windows.DuplicateTokenEx(userToken, windows.TOKEN_QUERY, nil, windows.SecurityImpersonation, windows.TokenImpersonation, &impersonationToken)
		// 	}
		// 	if err == nil {
		// 		isOperator, err = impersonationToken.IsMember(operatorGroupSid)
		// 		isOperator = isOperator && err == nil
		// 		impersonationToken.Close()
		// 	}
		// }
		isAdminUser := isAdmin
		userToken.Close()
		_ = isAdminUser

[klisza1993]

So I need to be logged as admin? The installation asks for UAC, so that seems to be a bug?

[klisza1993]

I believe the following lines in windows-0.5.0/managers/service.go are causing the problem:

// Check if token is elevated
isAdmin := userToken.IsElevated()

// ...
if !isAdmin && !isOperator {
    userToken.Close()
    return
}

The manager service checks every logged-in session

and only starts the UI if:

the user is an administrator OR

an “operator” mode (not yet implemented) is active.

Normal users are strictly excluded.

One option could be:

}
		// Check if token is elevated
		isAdmin := userToken.IsElevated()
		// Also check if it can be elevated via UAC
		if !isAdmin {
			// Try to get linked token (UAC elevation token)
			linkedToken, err := userToken.GetLinkedToken()
			if err == nil {
				isAdmin = linkedToken.IsElevated()
				linkedToken.Close()
			}
		}
		// TODO: Implement LimitedOperatorUI support when config management is added
		// if !isAdmin && conf.AdminBool("LimitedOperatorUI") && operatorGroupSid != nil {
		// 	linkedToken, err := userToken.GetLinkedToken()
		// 	var impersonationToken windows.Token
		// 	if err == nil {
		// 		err = windows.DuplicateTokenEx(linkedToken, windows.TOKEN_QUERY, nil, windows.SecurityImpersonation, windows.TokenImpersonation, &impersonationToken)
		// 		linkedToken.Close()
		// 	} else {
		// 		err = windows.DuplicateTokenEx(userToken, windows.TOKEN_QUERY, nil, windows.SecurityImpersonation, windows.TokenImpersonation, &impersonationToken)
		// 	}
		// 	if err == nil {
		// 		isOperator, err = impersonationToken.IsMember(operatorGroupSid)
		// 		isOperator = isOperator && err == nil
		// 		impersonationToken.Close()
		// 	}
		// }
		isAdminUser := isAdmin
		userToken.Close()
		_ = isAdminUser

So you are right. If the user is not logged in as an Admin (not in the admin group), then Pangolin Client won't work. I tested it just now, and with a standard user, it doesn't work.

[miloschwartz]

For now, the Windows client requires admin to run, but we're working on improving this shortly.

[klisza1993]

For now, the Windows client requires admin to run, but we're working on improving this shortly.

That is understandable that it requires an admin rights - but the point is that it wont run on standard user with elevated rights ;). So I must be logged as admin or be an admin member group to being able to run it . I hope you get my meaning:)

[miloschwartz]

Ah yes, that makes sense, and thanks for helping pin point the issue. Making this a priority to fix for the next Windows client release!

[klisza1993]

Ah yes, that makes sense, and thanks for helping pin point the issue. Making this a priority to fix for the next Windows client release!

Pleasure 😀 and big thx for your great job! :)

[miloschwartz]

@klisza1993 I think this is fixed in 0.5.1. Can you try and let me know?

[p0se]

@klisza1993 I think this is fixed in 0.5.1. Can you try and let me know?

Unfortunately, it has not been fixed.

The problem is still present in version 0.5.1.

[ekadin-mtc]

It works for me now in 0.5.1

Still waiting for the ability to run it without needing elevated permission each time though.

Keep up the great work!