{"record":{"id":"09f5ed6695be32cc","repo":"puppetlabs/puppet","slug":"failed-to-call-lookupaccountnamew-with-account","errorCode":null,"errorMessage":"Failed to call LookupAccountNameW with account: %{account_name}","messagePattern":"Failed to call LookupAccountNameW with account: %(.+?)","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/principal.rb","lineNumber":76,"sourceCode":" FFI::MemoryPointer.from_string_to_wide_string(account_name) do |account_name_ptr|\n FFI::MemoryPointer.new(:byte, MAXIMUM_SID_BYTE_LENGTH) do |sid_ptr|\n FFI::MemoryPointer.new(:dword, 1) do |sid_length_ptr|\n FFI::MemoryPointer.new(:dword, 1) do |domain_length_ptr|\n FFI::MemoryPointer.new(:uint32, 1) do |name_use_enum_ptr|\n sid_length_ptr.write_dword(MAXIMUM_SID_BYTE_LENGTH)\n success = LookupAccountNameW(system_name_ptr, account_name_ptr, sid_ptr, sid_length_ptr,\n FFI::Pointer::NULL, domain_length_ptr, name_use_enum_ptr)\n last_error = FFI.errno\n\n if success == FFI::WIN32_FALSE && last_error != ERROR_INSUFFICIENT_BUFFER\n raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountNameW with account: %{account_name}') % { account_name: account_name }, last_error)\n end\n\n FFI::MemoryPointer.new(:lpwstr, domain_length_ptr.read_dword) do |domain_ptr|\n if LookupAccountNameW(system_name_ptr, account_name_ptr,\n sid_ptr, sid_length_ptr,\n domain_ptr, domain_length_ptr, name_use_enum_ptr) == FFI::WIN32_FALSE\n raise Puppet::Util::Windows::Error, _('Failed to call LookupAccountNameW with account: %{account_name}') % { account_name: account_name }\n end\n\n # with a SID returned, loop back through lookup_account_sid to retrieve official name\n # necessary when accounts like . or '' are passed in\n return lookup_account_sid(\n system_name,\n sid_ptr.read_bytes(sid_length_ptr.read_dword).unpack('C*')\n )\n end\n end\n end\n end\n end\n end\n ensure\n system_name_ptr.free if system_name_ptr != FFI::Pointer::NULL\n end\n end","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/principal.rb#L58-L94","documentation":"Raised by Puppet::Util::Windows::Principal.lookup_account_name (lib/puppet/util/windows/principal.rb:76) when the Win32 LookupAccountNameW API cannot resolve an account name into a SID. The sizing call is only allowed to fail with ERROR_INSUFFICIENT_BUFFER (122); any other code on the first call, or any failure of the second real lookup call, raises Puppet::Util::Windows::Error carrying the account name. The exception exposes the Win32 code as Error#code and its message is suffixed with FormatMessageW text. In practice it means the name is unknown on this host or its domain, or the domain cannot be queried.","triggerScenarios":"Calling Principal.lookup_account_name with a nonexistent or misspelled account; a DOMAIN\\user name for an untrusted or unreachable domain; the process running under LOCAL SERVICE or a detached SYSTEM context that cannot reach a domain controller (ERROR_NONE_MAPPED 1332 or trust errors 1788/1789); the second LookupAccountNameW call failing after the sizing pass.","commonSituations":"ACL/security manifests referencing deleted or renamed users and groups; broken Active Directory trust or lost secure channel; machine disjoined from the domain while manifests still use domain accounts; agent running as a service with no network path to a DC during catalog application.","solutions":["Resolve safely first: Puppet::Util::Windows::SID.name_to_sid / name_to_principal return nil instead of raising when the account is unknown.","Verify the account on the host itself: net user for local accounts, net user /domain or whoami /user for domain accounts.","Use fully qualified names (DOMAIN\\user or COMPUTERNAME\\user) instead of bare ambiguous names.","For domain accounts confirm DC reachability and trust with nltest /dsgetdc: and nltest /sc_query:; repair the trust or rejoin if they fail.","Rescue Puppet::Util::Windows::Error and branch on e.code: 1332 means no mapping, 1788/1789 mean domain/trust failure."],"exampleFix":"# before — raises when the account is unknown\nprincipal = Principal.lookup_account_name(account_name)\n\n# after — use the non-raising resolver and handle nil explicitly\nsid = Puppet::Util::Windows::SID.name_to_sid(account_name)\nif sid.nil?\n Puppet.err \"Account #{account_name} does not resolve on this host\"\nelse\n principal = Puppet::Util::Windows::SID.name_to_principal(account_name)\nend","handlingStrategy":"try-catch","validationCode":"# name_to_sid resolves without raising; nil means unknown account\nif Puppet::Util::Windows::SID.name_to_sid(account_name).nil?\n Puppet.err \"Unresolvable account: #{account_name}\"\n return\nend","typeGuard":null,"tryCatchPattern":"begin\n principal = Principal.lookup_account_name(account_name)\nrescue Puppet::Util::Windows::Error => e\n case e.code\n when 1332 then Puppet.err \"No mapping for #{account_name} (ERROR_NONE_MAPPED)\"\n when 1788, 1789 then Puppet.err \"Domain trust failure for #{account_name}: #{e.message}\"\n else raise\n end\nend","preventionTips":["Prefer SID.name_to_sid / name_to_principal — they return nil for unknown accounts instead of raising","Use fully qualified DOMAIN\\user names in manifests and ACL data","Verify domain trust and DC reachability before catalog runs on domain-joined nodes","Never hardcode account names without a documented fallback account"],"tags":["windows","win32-api","ffi","sid","account-resolution","puppet"],"backgroundTag":"win32-account-name-resolution-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}