{"record":{"id":"012728b8009179e7","repo":"puppetlabs/puppet","slug":"unrecognized-ads-userflags-unrecognized-flags","errorCode":null,"errorMessage":"Unrecognized ADS UserFlags: %{unrecognized_flags}","messagePattern":"Unrecognized ADS UserFlags: %(.+?)","errorType":"validation","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/adsi.rb","lineNumber":468,"sourceCode":"      ADS_UF_PASSWORD_EXPIRED: 0x800000,\n      ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: 0x1000000\n    }\n\n    def userflag_set?(flag)\n      flag_value = ADS_USERFLAGS[flag] || 0\n      !(self['UserFlags'] & flag_value).zero?\n    end\n\n    # Common helper for set_userflags and unset_userflags.\n    #\n    # @api private\n    def op_userflags(*flags, &block)\n      # Avoid an unnecessary set + commit operation.\n      return if flags.empty?\n\n      unrecognized_flags = flags.reject { |flag| ADS_USERFLAGS.keys.include?(flag) }\n      unless unrecognized_flags.empty?\n        raise ArgumentError, _(\"Unrecognized ADS UserFlags: %{unrecognized_flags}\") % { unrecognized_flags: unrecognized_flags.join(', ') }\n      end\n\n      self['UserFlags'] = flags.inject(self['UserFlags'], &block)\n    end\n\n    def set_userflags(*flags)\n      op_userflags(*flags) { |userflags, flag| userflags | ADS_USERFLAGS[flag] }\n    end\n\n    def unset_userflags(*flags)\n      op_userflags(*flags) { |userflags, flag| userflags & ~ADS_USERFLAGS[flag] }\n    end\n\n    def disabled?\n      userflag_set?(:ADS_UF_ACCOUNTDISABLE)\n    end\n\n    def locked_out?","sourceCodeStart":450,"sourceCodeEnd":486,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/adsi.rb#L450-L486","documentation":"ArgumentError raised by User#op_userflags (shared by set_userflags / unset_userflags) when a flag argument is not a key of the ADS_USERFLAGS table that maps names like UF_SCRIPT or UF_DONT_EXPIRE_PASSWD to ADSI bit values. Unknown names cannot be translated, and the whole set operation is rejected before touching UserFlags.","triggerScenarios":"user.set_userflags('UF_SCRIPT', 'UF_MY_FLAG'), or a manifest feeding the user resource's flag handling with a misspelled name like 'UF_DONT_EXPIRE_PASSWRD' that is absent from ADS_USERFLAGS.","commonSituations":"Typos in flag names copied from MSDN; flags valid for a different ADSI schema version than the one Puppet's constant table covers.","solutions":["List the supported names with Puppet::Util::Windows::ADSI::User::ADS_USERFLAGS.keys and correct the spelling.","Drop the unsupported flag, or upgrade Puppet if the flag is a legitimate ADSI constant missing from the table."],"exampleFix":"# before\nuser.set_userflags('UF_DONT_EXPIRE_PASSWRD') # raises Unrecognized ADS UserFlags\n\n# after\nuser.set_userflags('UF_DONT_EXPIRE_PASSWD')","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"KNOWN_FLAGS = Puppet::Util::Windows::ADSI::User::ADS_USERFLAGS.keys\ndef valid_userflags?(flags)\n  flags.all? { |f| KNOWN_FLAGS.include?(f) }\nend\nvalid_userflags?(['UF_SCRIPT', 'UF_DONT_EXPIRE_PASSWD']) # => true","tryCatchPattern":"begin\n  user.set_userflags(*flags)\nrescue ArgumentError => e\n  raise \"rejected userflags #{flags.inspect}: supported names are #{KNOWN_FLAGS.inspect}\"\nend","preventionTips":["Use flag names exactly as printed by ADS_USERFLAGS.keys.","Print the supported list when unsure instead of guessing.","Spec-test flag name lists in modules that expose them."],"tags":["puppet","windows","adsi","user-flags","enum","validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}