{"record":{"id":"3d7c304093ed1eff","repo":"puppetlabs/puppet","slug":"normalized-logon-account-is-not-a-valid-acco","errorCode":null,"errorMessage":"\"#{@normalized_logon_account}\" is not a valid account","messagePattern":"\"#(.+?)\" is not a valid account","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/provider/service/windows.rb","lineNumber":167,"sourceCode":"    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: { logon_password: value })\n  end\n\n  private\n\n  def normalize_logonaccount\n    logon_account = @resource[:logonaccount].sub(/^\\.\\\\/, \"#{Puppet::Util::Windows::ADSI.computer_name}\\\\\")\n    return 'LocalSystem' if Puppet::Util::Windows::User.localsystem?(logon_account)\n\n    @logonaccount_information ||= Puppet::Util::Windows::SID.name_to_principal(logon_account)\n    return logon_account unless @logonaccount_information\n    return \".\\\\#{@logonaccount_information.account}\" if @logonaccount_information.domain == Puppet::Util::Windows::ADSI.computer_name\n\n    @logonaccount_information.domain_account\n  end\n\n  def validate_logon_credentials\n    unless Puppet::Util::Windows::User.localsystem?(@normalized_logon_account)\n      raise Puppet::Error, \"\\\"#{@normalized_logon_account}\\\" is not a valid account\" unless @logonaccount_information && [:SidTypeUser, :SidTypeWellKnownGroup].include?(@logonaccount_information.account_type)\n\n      user_rights = Puppet::Util::Windows::User.get_rights(@logonaccount_information.domain_account) unless Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account)\n      raise Puppet::Error, \"\\\"#{@normalized_logon_account}\\\" has the 'Log On As A Service' right set to denied.\" if user_rights =~ /SeDenyServiceLogonRight/\n      raise Puppet::Error, \"\\\"#{@normalized_logon_account}\\\" is missing the 'Log On As A Service' right.\" unless user_rights.nil? || user_rights =~ /SeServiceLogonRight/\n    end\n\n    is_a_predefined_local_account = Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account) || @normalized_logon_account == 'LocalSystem'\n    account_info = @normalized_logon_account.split(\"\\\\\")\n    able_to_logon = Puppet::Util::Windows::User.password_is?(account_info[1], @resource[:logonpassword], account_info[0]) unless is_a_predefined_local_account\n    raise Puppet::Error, \"The given password is invalid for user '#{@normalized_logon_account}'.\" unless is_a_predefined_local_account || able_to_logon\n  end\nend\n","sourceCodeStart":149,"sourceCodeEnd":180,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/provider/service/windows.rb#L149-L180","documentation":"Raised by Puppet's Windows service provider while validating `logonaccount`: the account name could not be resolved to a principal (Puppet::Util::Windows::SID.name_to_principal returned nil), or the resolved principal is not of type SidTypeUser or SidTypeWellKnownGroup (e.g., it is a domain group or computer account). Part of validate_logon_credentials, run before setting service logon credentials.","triggerScenarios":"Declaring a Windows service with `logonaccount => 'DOMAIN\\missing_user'` (account does not exist), a malformed account string that cannot be resolved, or an account that resolves to a group (SidTypeGroup) or alias that is not permitted to log on as a service principal.","commonSituations":"Service account not yet created or renamed in AD; typo in domain or username; using a domain security group as logon account; running disconnected from the domain controller so name_to_principal fails.","solutions":["Verify the account exists: `net user <name> /domain` or PowerShell `Get-ADUser <name>`; fix the string in the manifest.","Use the fully qualified form 'DOMAIN\\user' or '.\\localuser' (the provider expands the leading '.\\' to the computer name).","If a built-in account is intended, use 'LocalSystem' or a well-known account, which take a separate path in validation.","Ensure the node can reach a domain controller and that name resolution (SID translation) succeeds before the Puppet run."],"exampleFix":"# before\nservice { 'myapp':\n  ensure       => running,\n  logonaccount => 'DOMAIN\\\\svc_mapp',   # account does not exist\n}\n# after\nservice { 'myapp':\n  ensure       => running,\n  logonaccount => 'DOMAIN\\\\svc_myapp',\n}","handlingStrategy":"validation","validationCode":"account = 'DOMAIN\\\\svc_myapp'\nprincipal = Puppet::Util::Windows::SID.name_to_principal(account)\nraise ArgumentError, \"unresolvable account #{account}\" unless principal\nraise ArgumentError, \"wrong principal type #{principal.account_type}\" unless %i[SidTypeUser SidTypeWellKnownGroup].include?(principal.account_type)","typeGuard":"def valid_logon_account?(account)\n  return true if Puppet::Util::Windows::User.localsystem?(account)\n  p = Puppet::Util::Windows::SID.name_to_principal(account)\n  !p.nil? && %i[SidTypeUser SidTypeWellKnownGroup].include?(p.account_type)\nend","tryCatchPattern":null,"preventionTips":["Pre-validate accounts with name_to_principal before managing logonaccount.","Use fully qualified 'DOMAIN\\\\user' or '.\\\\localuser' forms.","Create/verify service accounts (and DC reachability) before the run that references them."],"tags":["windows","service-account","puppet","active-directory"],"backgroundTag":"invalid-service-logon-account","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}