{"record":{"id":"3170add7a0eca592","repo":"puppetlabs/puppet","slug":"failed-to-call-lookupaccountsidw-with-bytes-sid","errorCode":null,"errorMessage":"Failed to call LookupAccountSidW with bytes: %{sid_bytes}","messagePattern":"Failed to call LookupAccountSidW with bytes: %(.+?)","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/principal.rb","lineNumber":131,"sourceCode":"                sid_ptr.write_array_of_uchar(sid_bytes)\n\n                if Puppet::Util::Windows::SID.IsValidSid(sid_ptr) == FFI::WIN32_FALSE\n                  raise Puppet::Util::Windows::Error.new(_('Byte array for lookup_account_sid is invalid: %{sid_bytes}') % { sid_bytes: sid_bytes }, ERROR_INVALID_PARAMETER)\n                end\n\n                success = LookupAccountSidW(system_name_ptr, sid_ptr, FFI::Pointer::NULL, name_length_ptr,\n                                            FFI::Pointer::NULL, domain_length_ptr, name_use_enum_ptr)\n                last_error = FFI.errno\n\n                if success == FFI::WIN32_FALSE && last_error != ERROR_INSUFFICIENT_BUFFER\n                  raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountSidW with bytes: %{sid_bytes}') % { sid_bytes: sid_bytes }, last_error)\n                end\n\n                FFI::MemoryPointer.new(:lpwstr, name_length_ptr.read_dword) do |name_ptr|\n                  FFI::MemoryPointer.new(:lpwstr, domain_length_ptr.read_dword) do |domain_ptr|\n                    if LookupAccountSidW(system_name_ptr, sid_ptr, name_ptr, name_length_ptr,\n                                         domain_ptr, domain_length_ptr, name_use_enum_ptr) == FFI::WIN32_FALSE\n                      raise Puppet::Util::Windows::Error, _('Failed to call LookupAccountSidW with bytes: %{sid_bytes}') % { sid_bytes: sid_bytes }\n                    end\n\n                    return new(\n                      name_ptr.read_wide_string(name_length_ptr.read_dword),\n                      sid_bytes,\n                      Puppet::Util::Windows::SID.sid_ptr_to_string(sid_ptr),\n                      domain_ptr.read_wide_string(domain_length_ptr.read_dword),\n                      SID_NAME_USE[name_use_enum_ptr.read_uint32]\n                    )\n                  end\n                end\n              end\n            end\n          end\n        end\n      ensure\n        system_name_ptr.free if system_name_ptr != FFI::Pointer::NULL\n      end","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/principal.rb#L113-L149","documentation":"Raised by Principal.lookup_account_sid (lib/puppet/util/windows/principal.rb:131) when the Win32 LookupAccountSidW call fails while translating SID bytes into an account/domain name. Note that the byte array has already passed an IsValidSid check earlier in the method, so the SID is structurally valid — failure means lookup failure: ERROR_NONE_MAPPED (1332) for SIDs with no owning account (deleted users, orphaned SIDs), or domain/trust errors for foreign SIDs.","triggerScenarios":"Resolving a SID whose account was deleted (orphaned SID in a DACL or local group); a domain SID from an untrusted or unreachable domain (ERROR_TRUSTED_DOMAIN_FAILURE 1788 / ERROR_TRUSTED_RELATIONSHIP_FAILURE 1789); the second LookupAccountSidW call failing after the sizing pass returned only ERROR_INSUFFICIENT_BUFFER.","commonSituations":"Local groups containing removed domain users (common after domain cleanups); DACLs carrying SIDs from other machines or stale backups; disjoined hosts resolving domain SIDs; SID arrays copied between environments.","solutions":["Rescue Puppet::Util::Windows::Error and treat e.code == 1332 (ERROR_NONE_MAPPED) as 'account gone' rather than a hard failure.","When starting from a SID string, use SID.name_to_principal(name, true) — allow_unresolved returns an unresolved Principal instead of raising.","For domain SIDs, verify trust and DC reachability (nltest /sc_query:<domain>) before failing.","Clean up orphaned SIDs in local groups if they pollute the data you process."],"exampleFix":"# before\nprincipal = Principal.lookup_account_sid(sid_bytes)\n\n# after — tolerate unresolvable (orphaned) SIDs\nbegin\n  principal = Principal.lookup_account_sid(sid_bytes)\nrescue Puppet::Util::Windows::Error => e\n  raise unless e.code == 1332 # ERROR_NONE_MAPPED\n  principal = nil\nend","handlingStrategy":"try-catch","validationCode":"# If the SID originated as a string, confirm it converts before resolving\nPuppet::Util::Windows::SID.string_to_sid_ptr(sid_string) do |ptr|\n  raise ArgumentError, \"invalid SID string #{sid_string}\" if Puppet::Util::Windows::SID.IsValidSid(ptr) == FFI::WIN32_FALSE\nend","typeGuard":null,"tryCatchPattern":"begin\n  principal = Principal.lookup_account_sid(sid_bytes)\nrescue Puppet::Util::Windows::Error => e\n  raise unless e.code == 1332 # ERROR_NONE_MAPPED — orphaned SID\n  principal = nil # or build an unresolved marker\nend","preventionTips":["Use SID.name_to_principal(name, true) when unresolved SIDs are acceptable","Audit local groups for orphaned domain SIDs before processing them","Do not copy SID data between machines or domains and assume it resolves"],"tags":["windows","win32-api","ffi","sid","account-resolution","puppet"],"backgroundTag":"win32-sid-resolution-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}