{"record":{"id":"64aaf226450612db","repo":"puppetlabs/puppet","slug":"calling-method-name-returned-win32-error-cod","errorCode":null,"errorMessage":"Calling `#{method_name}` returned 'Win32 Error Code 0x%08X'. #{error_reason}","messagePattern":"Calling `#(.+?)` returned 'Win32 Error Code 0x%08X'\\. #(.+?)","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/user.rb","lineNumber":261,"sourceCode":"\n  # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/18d8fbe8-a967-4f1c-ae50-99ca8e491d2d\n  def self.check_lsa_nt_status_and_raise_failures(status, method_name)\n    error_code = LsaNtStatusToWinError(status)\n\n    error_reason = case error_code.to_s(16)\n                   when '0' # ERROR_SUCCESS\n                     return # Method call succeded\n                   when '2' # ERROR_FILE_NOT_FOUND\n                     return # No rights/privilleges assigned to given user\n                   when '5' # ERROR_ACCESS_DENIED\n                     \"Access is denied. Please make sure that puppet is running as administrator.\"\n                   when '521' # ERROR_NO_SUCH_PRIVILEGE\n                     \"One or more of the given rights/privilleges are incorrect.\"\n                   when '6ba' # RPC_S_SERVER_UNAVAILABLE\n                     \"The RPC server is unavailable or given domain name is invalid.\"\n                   end\n\n    raise Puppet::Error, \"Calling `#{method_name}` returned 'Win32 Error Code 0x%08X'. #{error_reason}\" % error_code\n  end\n  private_class_method :check_lsa_nt_status_and_raise_failures\n\n  ffi_convention :stdcall\n\n  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx\n  # BOOL LogonUser(\n  #   _In_      LPTSTR lpszUsername,\n  #   _In_opt_  LPTSTR lpszDomain,\n  #   _In_opt_  LPTSTR lpszPassword,\n  #   _In_      DWORD dwLogonType,\n  #   _In_      DWORD dwLogonProvider,\n  #   _Out_     PHANDLE phToken\n  # );\n  ffi_lib :advapi32\n  attach_function_private :LogonUserW,\n                          [:lpwstr, :lpwstr, :lpwstr, :dword, :dword, :phandle], :win32_bool\n","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/user.rb#L243-L279","documentation":"Raised by check_lsa_nt_status_and_raise_failures — the shared checker for the LSA (Local Security Authority) calls used by get_rights, set_rights, remove_rights and the LsaOpenPolicy/LsaClose/LsaFreeMemory plumbing. It converts the NTSTATUS to a Win32 code via LsaNtStatusToWinError and prints it in hex with a friendly reason for the common cases: 0x5 access denied (run as administrator), 0x521 no such privilege (bad right name), 0x6ba RPC server unavailable (domain/DC unreachable). Success (0x0) and ERROR_FILE_NOT_FOUND (0x2, 'no rights assigned') return quietly; unmapped codes raise with an empty reason.","triggerScenarios":"Managing privileges/rights via set_rights/remove_rights without elevation -> LsaOpenPolicy or LsaAddAccountRights returns STATUS_ACCESS_DENIED (maps to 0x5); a misspelled privilege like 'SeServiceLogonRite' -> ERROR_NO_SUCH_PRIVILEGE (0x521); domain-joined machine cannot reach a DC -> RPC_S_SERVER_UNAVAILABLE (0x6ba); the account name not resolving so a nil/garbage SID is passed; LsaFreeMemory/LsaClose failures from corrupted handles.","commonSituations":"user_rights (or custom rbac) manifests applied by a non-elevated Puppet agent; privilege names with wrong casing or typos in YAML/manifest data; laptops away from the network managing domain accounts; accounts renamed/deleted between compile and apply; code assuming error_reason is always set — unmapped codes print 'Win32 Error Code 0x...' with no reason text.","solutions":["Run Puppet elevated as Administrator — 0x5 access denied is by far the most common trigger for LSA policy writes.","Verify privilege names against the documented Se* list (e.g. SeServiceLogonRight, SeBatchLogonRight) — 0x521 means one of them is wrong.","For 0x6ba on domain-joined hosts, restore DC connectivity (VPN/network) or target the local SAM account form 'DOMAIN\\\\user' vs '.\\\\user' correctly.","Confirm the account exists first: Puppet::Util::Windows::SID.name_to_principal(name) returning nil will cause set_rights/remove_rights to blow up before/around the LSA call.","For unmapped codes (no reason text), decode the hex value against the MS-ERREF/NTSTATUS docs to identify the failing LSA call (method_name in the message says which API)."],"exampleFix":"# before\nPuppet::Util::Windows::User.set_rights('svc_app', ['SeServiceLogonRite']) # typo\n# -> Calling `LsaAddAccountRights` returned 'Win32 Error Code 0x00000521...'\n\n# after\nPuppet::Util::Windows::User.set_rights('svc_app', ['SeServiceLogonRight'])","handlingStrategy":"try-catch","validationCode":"# resolve the account and validate right names before touching LSA\nprincipal = Puppet::Util::Windows::SID.name_to_principal(name.sub(/^\\.\\\\/, \"#{Puppet::Util::Windows::ADSI.computer_name}\\\\\"))\nraise ArgumentError, \"cannot resolve account #{name}\" unless principal\n\nKNOWN_RIGHTS = %w[SeServiceLogonRight SeBatchLogonRight SeInteractiveLogonRight SeNetworkLogonRight SeDenyRemoteInteractiveLogonRight ...]\nbad = rights - KNOWN_RIGHTS\nraise ArgumentError, \"unknown privileges: #{bad.join(', ')}\" unless bad.empty?","typeGuard":null,"tryCatchPattern":"begin\n  Puppet::Util::Windows::User.set_rights(name, rights)\nrescue Puppet::Error => e\n  msg = e.message\n  raise unless msg.include?('Win32 Error Code')\n  case msg\n  when /0x00000005/ then raise 'run Puppet elevated: LSA access denied'\n  when /0x00000521/ then raise \"misspelled privilege in #{rights.inspect}\"\n  when /0x000006ba/ then raise 'domain controller unreachable (RPC)'\n  else raise\n  end\nend","preventionTips":["Run privilege/rights management elevated — LSA policy writes require administrator.","Maintain a validated list of Se* privilege names and lint manifests against it.","Resolve account names to principals before set/remove_rights to avoid nil-SID paths.","On domain-joined hosts, verify DC reachability before rights changes that touch domain accounts."],"tags":["windows","lsa","privileges","user-rights","access-denied","puppet"],"backgroundTag":"lsa-account-rights-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}