{"record":{"id":"294dcdfabe028973","repo":"puppetlabs/puppet","slug":"normalized-logon-account-is-missing-the-log","errorCode":null,"errorMessage":"\"#{@normalized_logon_account}\" is missing the 'Log On As A Service' right.","messagePattern":"\"#(.+?)\" is missing the 'Log On As A Service' right\\.","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/provider/service/windows.rb","lineNumber":171,"sourceCode":"\n  def normalize_logonaccount\n    logon_account = @resource[:logonaccount].sub(/^\\.\\\\/, \"#{Puppet::Util::Windows::ADSI.computer_name}\\\\\")\n    return 'LocalSystem' if Puppet::Util::Windows::User.localsystem?(logon_account)\n\n    @logonaccount_information ||= Puppet::Util::Windows::SID.name_to_principal(logon_account)\n    return logon_account unless @logonaccount_information\n    return \".\\\\#{@logonaccount_information.account}\" if @logonaccount_information.domain == Puppet::Util::Windows::ADSI.computer_name\n\n    @logonaccount_information.domain_account\n  end\n\n  def validate_logon_credentials\n    unless Puppet::Util::Windows::User.localsystem?(@normalized_logon_account)\n      raise Puppet::Error, \"\\\"#{@normalized_logon_account}\\\" is not a valid account\" unless @logonaccount_information && [:SidTypeUser, :SidTypeWellKnownGroup].include?(@logonaccount_information.account_type)\n\n      user_rights = Puppet::Util::Windows::User.get_rights(@logonaccount_information.domain_account) unless Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account)\n      raise Puppet::Error, \"\\\"#{@normalized_logon_account}\\\" has the 'Log On As A Service' right set to denied.\" if user_rights =~ /SeDenyServiceLogonRight/\n      raise Puppet::Error, \"\\\"#{@normalized_logon_account}\\\" is missing the 'Log On As A Service' right.\" unless user_rights.nil? || user_rights =~ /SeServiceLogonRight/\n    end\n\n    is_a_predefined_local_account = Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account) || @normalized_logon_account == 'LocalSystem'\n    account_info = @normalized_logon_account.split(\"\\\\\")\n    able_to_logon = Puppet::Util::Windows::User.password_is?(account_info[1], @resource[:logonpassword], account_info[0]) unless is_a_predefined_local_account\n    raise Puppet::Error, \"The given password is invalid for user '#{@normalized_logon_account}'.\" unless is_a_predefined_local_account || able_to_logon\n  end\nend\n","sourceCodeStart":153,"sourceCodeEnd":180,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/provider/service/windows.rb#L153-L180","documentation":"Raised by Puppet's Windows service provider when the logon account's rights string is non-nil but lacks SeServiceLogonRight — the account does not hold the 'Log On As A Service' right. (A nil rights string passes, representing unresolvable/no explicit assignment.) The check runs in validate_logon_credentials before Puppet reconfigures the service to run as this account.","triggerScenarios":"Setting `logonaccount`/`logonpassword` on a Windows service for an account that exists and is a valid user type, but was never granted the right via Local Security Policy, GPO, or installer.","commonSituations":"Freshly created service accounts without the right; right previously granted only on another machine; GPO that defines 'Log On As A Service' explicitly and does not include the new account, overwriting local grants.","solutions":["Grant the right via Local Security Policy (secpol.msc > Local Policies > User Rights Assignment > 'Log on as a service') or preferably via GPO so it is reproducible.","Automate the grant with a tool such as the puppet-local_security_policy module or a DSC resource instead of manual clicks.","Verify effective policy after `gpupdate /force`: export with `secedit /export /cfg p.cfg` and confirm the account appears under SeServiceLogonRight.","If a domain GPO overwrites local grants, add the account to the GPO's list rather than setting it locally."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"rights = Puppet::Util::Windows::User.get_rights('DOMAIN\\\\svc_myapp')\nraise 'missing Log On As A Service right' unless rights.nil? || rights =~ /SeServiceLogonRight/","typeGuard":"def service_logon_granted?(domain_account)\n  rights = Puppet::Util::Windows::User.get_rights(domain_account)\n  rights.nil? || rights =~ /SeServiceLogonRight/\nend","tryCatchPattern":null,"preventionTips":["Grant 'Log on as a service' via GPO or a local_security_policy module as part of service provisioning, before the service resource.","Order the right-granting resource before the service with logonaccount.","After gpupdate, verify with secedit export that the account is listed."],"tags":["windows","user-rights","service-account","group-policy","puppet"],"backgroundTag":"missing-logon-as-service-right","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}