{"record":{"id":"2ce7c00225370d52","repo":"puppetlabs/puppet","slug":"lookupprivilegevalue-system-name-name-lu","errorCode":null,"errorMessage":"LookupPrivilegeValue(#{system_name}, #{name}, #{luid_ptr})","messagePattern":"LookupPrivilegeValue\\(#(.+?), #(.+?), #(.+?)\\)","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/process.rb","lineNumber":158,"sourceCode":"          end\n        end\n      end\n    end\n\n    image_name\n  end\n  module_function :get_process_image_name_by_pid\n\n  def lookup_privilege_value(name, system_name = '', &block)\n    FFI::MemoryPointer.new(LUID.size) do |luid_ptr|\n      result = LookupPrivilegeValueW(\n        wide_string(system_name),\n        wide_string(name.to_s),\n        luid_ptr\n      )\n\n      if result == FFI::WIN32_FALSE\n        raise Puppet::Util::Windows::Error, \"LookupPrivilegeValue(#{system_name}, #{name}, #{luid_ptr})\"\n      end\n\n      yield LUID.new(luid_ptr)\n    end\n\n    # the underlying MemoryPointer for LUID is cleaned up by this point\n    nil\n  end\n  module_function :lookup_privilege_value\n\n  def get_token_information(token_handle, token_information, &block)\n    # to determine buffer size\n    FFI::MemoryPointer.new(:dword, 1) do |return_length_ptr|\n      result = GetTokenInformation(token_handle, token_information, nil, 0, return_length_ptr)\n      return_length = return_length_ptr.read_dword\n\n      if return_length <= 0\n        raise Puppet::Util::Windows::Error, \"GetTokenInformation(#{token_handle}, #{token_information}, nil, 0, #{return_length_ptr})\"","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/process.rb#L140-L176","documentation":"Raised by Process.lookup_privilege_value (lib/puppet/util/windows/process.rb:158) when LookupPrivilegeValueW cannot turn a privilege display name into a LUID — the name does not exist on the target system, or system_name could not be contacted. Puppet resolves names like SeDebugPrivilege here before enabling them via Security.with_privilege. ERROR_NO_SUCH_PRIVILEGE (1313) is the expected code; Puppet itself special-cases it for SeCreateSymbolicLinkPrivilege on pre-Vista hosts in process_privilege_symlink?.","triggerScenarios":"A typo'd privilege string such as 'SeDebugPriviledge'; a privilege not defined on this Windows SKU or edition (some exist only on Domain Controllers); system_name pointing at an unreachable or decommissioned host; pre-Vista systems lacking newer privileges.","commonSituations":"Hardcoded privilege names in custom elevation code; privilege constants copied from newer SDK docs onto older hosts; remote system_name values that no longer resolve.","solutions":["Use exact names from the Windows Privilege Constants documentation — 'SeDebugPrivilege', 'SeSecurityPrivilege', 'SeBackupPrivilege' — and check spelling first.","Confirm the privilege exists on the host: run whoami /priv (for held privileges) or inspect the local security policy.","Leave system_name as '' (local) unless you specifically need a remote LUID.","Rescue and treat e.code == 1313 (ERROR_NO_SUCH_PRIVILEGE) as 'not supported here' — skip gracefully the way process_privilege_symlink? does."],"exampleFix":"# before — typo'd name never resolves\nProcess.lookup_privilege_value('SeDebugPriviledge') { |luid| use(luid) }\n\n# after — exact name, graceful skip on unsupported hosts\nbegin\n  Process.lookup_privilege_value('SeDebugPrivilege') { |luid| use(luid) }\nrescue Puppet::Util::Windows::Error => e\n  raise unless e.code == 1313 # ERROR_NO_SUCH_PRIVILEGE\nend","handlingStrategy":"validation","validationCode":"KNOWN_PRIVILEGES = %w[SeDebugPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeBackupPrivilege\n                  SeRestorePrivilege SeImpersonatePrivilege SeCreateSymbolicLinkPrivilege].freeze\nraise ArgumentError, \"unknown privilege #{name.inspect}\" unless KNOWN_PRIVILEGES.include?(name)\nProcess.lookup_privilege_value(name) { |luid| use(luid) }","typeGuard":null,"tryCatchPattern":"begin\n  Process.lookup_privilege_value(name) { |luid| yield luid }\nrescue Puppet::Util::Windows::Error => e\n  raise unless e.code == 1313 # ERROR_NO_SUCH_PRIVILEGE — not on this host\n  Puppet.debug \"privilege #{name} unavailable; skipping\"\nend","preventionTips":["Copy privilege names verbatim from the Windows Privilege Constants docs — they are literal strings, not symbols","Confirm availability with whoami /priv or secpol.msc on the target SKU","Handle code 1313 explicitly for OS version differences instead of failing hard"],"tags":["windows","win32-api","privilege","luid","validation","puppet"],"backgroundTag":"win32-invalid-privilege-name","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}