{"record":{"id":"41e15c1edadf96d0","repo":"puppetlabs/puppet","slug":"the-given-password-is-invalid-for-user-normali","errorCode":null,"errorMessage":"The given password is invalid for user '#{@normalized_logon_account}'.","messagePattern":"The given password is invalid for user '#(.+?)'\\.","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/provider/service/windows.rb","lineNumber":177,"sourceCode":"    return logon_account unless @logonaccount_information\n    return \".\\\\#{@logonaccount_information.account}\" if @logonaccount_information.domain == Puppet::Util::Windows::ADSI.computer_name\n\n    @logonaccount_information.domain_account\n  end\n\n  def validate_logon_credentials\n    unless Puppet::Util::Windows::User.localsystem?(@normalized_logon_account)\n      raise Puppet::Error, \"\\\"#{@normalized_logon_account}\\\" is not a valid account\" unless @logonaccount_information && [:SidTypeUser, :SidTypeWellKnownGroup].include?(@logonaccount_information.account_type)\n\n      user_rights = Puppet::Util::Windows::User.get_rights(@logonaccount_information.domain_account) unless Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account)\n      raise Puppet::Error, \"\\\"#{@normalized_logon_account}\\\" has the 'Log On As A Service' right set to denied.\" if user_rights =~ /SeDenyServiceLogonRight/\n      raise Puppet::Error, \"\\\"#{@normalized_logon_account}\\\" is missing the 'Log On As A Service' right.\" unless user_rights.nil? || user_rights =~ /SeServiceLogonRight/\n    end\n\n    is_a_predefined_local_account = Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account) || @normalized_logon_account == 'LocalSystem'\n    account_info = @normalized_logon_account.split(\"\\\\\")\n    able_to_logon = Puppet::Util::Windows::User.password_is?(account_info[1], @resource[:logonpassword], account_info[0]) unless is_a_predefined_local_account\n    raise Puppet::Error, \"The given password is invalid for user '#{@normalized_logon_account}'.\" unless is_a_predefined_local_account || able_to_logon\n  end\nend\n","sourceCodeStart":159,"sourceCodeEnd":180,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/provider/service/windows.rb#L159-L180","documentation":"Raised by Puppet's Windows service provider when the supplied `logonpassword` fails validation for the given `logonaccount`. validate_logon_credentials splits the normalized account into domain and user and calls Puppet::Util::Windows::User.password_is?, which attempts an actual logon; returning false (wrong password) produces this error. Predefined local accounts (LocalSystem etc.) skip the check.","triggerScenarios":"Declaring a service with `logonaccount => 'DOMAIN\\\\svc_x', logonpassword => '...'` where the password is wrong, expired/locked out, the account must change password at next logon, or the manifest stored the password with mangled quoting/escaping so the string does not match.","commonSituations":"Password rotated in AD but not in Puppet (vault/Hiera); expired service-account password; single quotes vs escaping of special characters like `$` in manifests; copy-paste truncation of long passwords.","solutions":["Verify the credential interactively: `runas /user:DOMAIN\\svc_x cmd` or a PowerShell LogonUser test to confirm the password itself.","Update the password in Hiera/vault and re-run; prefer auto-retrieved secrets over inline literals.","Check account state for lockout/expiry (`Get-ADUser -Properties LockedOut,PasswordExpired`) and unlock/reset if needed.","Audit manifest quoting: in single-quoted Puppet strings, backslashes and `$` behave differently — ensure 'DOMAIN\\\\svc' and special characters are escaped correctly.","If the account's password policy forces periodic change, consider a gMSA so no password is managed at all."],"exampleFix":"# before - literal goes stale after rotation\nservice { 'myapp':\n  ensure        => running,\n  logonaccount  => 'DOMAIN\\\\svc_myapp',\n  logonpassword => 'Summer2024!',\n}\n# after - retrieve from secret store\nservice { 'myapp':\n  ensure        => running,\n  logonaccount  => 'DOMAIN\\\\svc_myapp',\n  logonpassword => lookup('profiles::myapp::svc_password', Sensitive),\n}","handlingStrategy":"validation","validationCode":"domain, user = 'DOMAIN\\\\svc_myapp'.split('\\\\')\nok = Puppet::Util::Windows::User.password_is?(user, candidate_password, domain)\nraise ArgumentError, 'credential check failed' unless ok","typeGuard":"def credential_valid?(account, password)\n  domain, user = account.split('\\\\')\n  Puppet::Util::Windows::User.password_is?(user, password, domain)\nend","tryCatchPattern":null,"preventionTips":["Store service passwords in Hiera/vault wrapped in Sensitive and rotate both sides together.","Watch manifest escaping of `$` and backslashes in single-quoted strings.","Prefer gMSAs on supported Windows versions so no password is managed."],"tags":["windows","credentials","service-account","puppet"],"backgroundTag":"invalid-service-credentials","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}