diff --git a/src/Tgstation.Server.Host/Security/ISystemIdentityFactory.cs b/src/Tgstation.Server.Host/Security/ISystemIdentityFactory.cs
index 604ad60d8a..e2e245e38e 100644
--- a/src/Tgstation.Server.Host/Security/ISystemIdentityFactory.cs
+++ b/src/Tgstation.Server.Host/Security/ISystemIdentityFactory.cs
@@ -22,7 +22,7 @@ namespace Tgstation.Server.Host.Security
 		/// <param name="user">The user to create a <see cref="ISystemIdentity"/> for.</param>
 		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation.</param>
 		/// <returns>A <see cref="Task{TResult}"/> resulting in a new <see cref="ISystemIdentity"/> based on the given <paramref name="user"/> or <see langword="null"/> if the <paramref name="user"/> has no <see cref="ISystemIdentity"/>.</returns>
-		Task<ISystemIdentity> CreateSystemIdentity(User user, CancellationToken cancellationToken);
+		Task<ISystemIdentity?> CreateSystemIdentity(User user, CancellationToken cancellationToken);
 
 		/// <summary>
 		/// Create a <see cref="ISystemIdentity"/> for a given username and password.
diff --git a/src/Tgstation.Server.Host/Security/PosixSystemIdentityFactory.cs b/src/Tgstation.Server.Host/Security/PosixSystemIdentityFactory.cs
index ae1cf2c036..062a42747f 100644
--- a/src/Tgstation.Server.Host/Security/PosixSystemIdentityFactory.cs
+++ b/src/Tgstation.Server.Host/Security/PosixSystemIdentityFactory.cs
@@ -16,7 +16,7 @@ namespace Tgstation.Server.Host.Security
 		public ISystemIdentity GetCurrent() => new PosixSystemIdentity();
 
 		/// <inheritdoc />
-		public Task<ISystemIdentity> CreateSystemIdentity(User user, CancellationToken cancellationToken) => throw new NotImplementedException();
+		public Task<ISystemIdentity?> CreateSystemIdentity(User user, CancellationToken cancellationToken) => throw new NotImplementedException();
 
 		/// <inheritdoc />
 		public Task<ISystemIdentity?> CreateSystemIdentity(string username, string password, CancellationToken cancellationToken) => throw new NotImplementedException();
diff --git a/src/Tgstation.Server.Host/Security/WindowsSystemIdentityFactory.cs b/src/Tgstation.Server.Host/Security/WindowsSystemIdentityFactory.cs
index 56b0435651..ca47a87192 100644
--- a/src/Tgstation.Server.Host/Security/WindowsSystemIdentityFactory.cs
+++ b/src/Tgstation.Server.Host/Security/WindowsSystemIdentityFactory.cs
@@ -1,4 +1,5 @@
 using System;
+using System.Diagnostics.CodeAnalysis;
 using System.DirectoryServices.AccountManagement;
 using System.Runtime.Versioning;
 using System.Security.Principal;
@@ -12,8 +13,6 @@ using Tgstation.Server.Host.IO;
 using Tgstation.Server.Host.Models;
 using Tgstation.Server.Host.System;
 
-#nullable disable
-
 namespace Tgstation.Server.Host.Security
 {
 	/// <summary>
@@ -33,7 +32,7 @@ namespace Tgstation.Server.Host.Security
 		/// <param name="input">The input <see cref="string"/>.</param>
 		/// <param name="username">The output username.</param>
 		/// <param name="domainName">The output domain name. May be <see langword="null"/>.</param>
-		static void GetUserAndDomainName(string input, out string username, out string domainName)
+		static void GetUserAndDomainName(string input, out string username, out string? domainName)
 		{
 			var splits = input.Split('\\');
 			username = splits.Length > 1 ? splits[1] : splits[0];
@@ -53,7 +52,7 @@ namespace Tgstation.Server.Host.Security
 		public ISystemIdentity GetCurrent() => new WindowsSystemIdentity(WindowsIdentity.GetCurrent());
 
 		/// <inheritdoc />
-		public Task<ISystemIdentity> CreateSystemIdentity(User user, CancellationToken cancellationToken) => Task.Factory.StartNew(
+		public Task<ISystemIdentity?> CreateSystemIdentity(User user, CancellationToken cancellationToken) => Task.Factory.StartNew(
 			() =>
 			{
 				ArgumentNullException.ThrowIfNull(user);
@@ -61,13 +60,12 @@ namespace Tgstation.Server.Host.Security
 				if (user.SystemIdentifier == null)
 					throw new InvalidOperationException("User's SystemIdentifier must not be null!");
 
-				PrincipalContext pc = null;
-				UserPrincipal principal = null;
-
+				PrincipalContext? pc = null;
 				GetUserAndDomainName(user.SystemIdentifier, out _, out var domainName);
 
-				bool TryGetPrincipalFromContextType(ContextType contextType)
+				bool TryGetPrincipalFromContextType(ContextType contextType, [NotNullWhen(true)] out UserPrincipal? principal)
 				{
+					principal = null;
 					try
 					{
 						pc = domainName != null
@@ -100,7 +98,7 @@ namespace Tgstation.Server.Host.Security
 					return principal != null;
 				}
 
-				if (!TryGetPrincipalFromContextType(ContextType.Machine) && !TryGetPrincipalFromContextType(ContextType.Domain))
+				if (!TryGetPrincipalFromContextType(ContextType.Machine, out var principal) && !TryGetPrincipalFromContextType(ContextType.Domain, out principal))
 					return null;
 				return (ISystemIdentity)new WindowsSystemIdentity(principal);
 			},
@@ -109,7 +107,7 @@ namespace Tgstation.Server.Host.Security
 			TaskScheduler.Current);
 
 		/// <inheritdoc />
-		public Task<ISystemIdentity> CreateSystemIdentity(string username, string password, CancellationToken cancellationToken) => Task.Factory.StartNew(
+		public Task<ISystemIdentity?> CreateSystemIdentity(string username, string password, CancellationToken cancellationToken) => Task.Factory.StartNew(
 			() =>
 			{
 				ArgumentNullException.ThrowIfNull(username);
diff --git a/src/Tgstation.Server.Host/System/NativeMethods.cs b/src/Tgstation.Server.Host/System/NativeMethods.cs
index 234ba0661a..ffba29cc9c 100644
--- a/src/Tgstation.Server.Host/System/NativeMethods.cs
+++ b/src/Tgstation.Server.Host/System/NativeMethods.cs
@@ -83,7 +83,7 @@ namespace Tgstation.Server.Host.System
 		/// See https://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx.
 		/// </summary>
 		[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
-		public static extern bool LogonUser(string lpszUsername, string lpszDomain, string lpszPassword, int dwLogonType, int dwLogonProvider, out IntPtr phToken);
+		public static extern bool LogonUser(string lpszUsername, string? lpszDomain, string lpszPassword, int dwLogonType, int dwLogonProvider, out IntPtr phToken);
 
 		/// <summary>
 		/// See https://docs.microsoft.com/en-us/windows/desktop/api/winbase/nf-winbase-createsymboliclinkw.