{"record":{"id":"656c1f3936621e6b","repo":"puppetlabs/puppet","slug":"failed-to-check-membership","errorCode":null,"errorMessage":"Failed to check membership","messagePattern":"Failed to check membership","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/user.rb","lineNumber":65,"sourceCode":"\n  def check_token_membership\n    is_admin = false\n    FFI::MemoryPointer.new(:byte, SECURITY_MAX_SID_SIZE) do |sid_pointer|\n      FFI::MemoryPointer.new(:dword, 1) do |size_pointer|\n        size_pointer.write_uint32(SECURITY_MAX_SID_SIZE)\n\n        if CreateWellKnownSid(:WinBuiltinAdministratorsSid, FFI::Pointer::NULL, sid_pointer, size_pointer) == FFI::WIN32_FALSE\n          raise Puppet::Util::Windows::Error, _(\"Failed to create administrators SID\")\n        end\n      end\n\n      if IsValidSid(sid_pointer) == FFI::WIN32_FALSE\n        raise Puppet::Util::Windows::Error, _(\"Invalid SID\")\n      end\n\n      FFI::MemoryPointer.new(:win32_bool, 1) do |ismember_pointer|\n        if CheckTokenMembership(FFI::Pointer::NULL_HANDLE, sid_pointer, ismember_pointer) == FFI::WIN32_FALSE\n          raise Puppet::Util::Windows::Error, _(\"Failed to check membership\")\n        end\n\n        # Is administrators SID enabled in calling thread's access token?\n        is_admin = ismember_pointer.read_win32_bool\n      end\n    end\n\n    is_admin\n  end\n  module_function :check_token_membership\n\n  def password_is?(name, password, domain = '.')\n    logon_user(name, password, domain) { |token| }\n  rescue Puppet::Util::Windows::Error => detail\n    authenticated_error_codes = Set[\n      ERROR_ACCOUNT_RESTRICTION,\n      ERROR_INVALID_LOGON_HOURS,\n      ERROR_INVALID_WORKSTATION,","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/user.rb#L47-L83","documentation":"Raised by Puppet::Util::Windows::User.check_token_membership when CheckTokenMembership itself fails (returns FALSE). CheckTokenMembership examines the effective token to test whether the administrators SID is enabled; failure means the API could not evaluate the token, which GetLastError (attached by Puppet::Util::Windows::Error) explains — commonly ERROR_NO_TOKEN when there is no impersonation/effective token to check.","triggerScenarios":"Calling check_token_membership from a context with no access token (some service/session-0 corner cases), an invalid token handle environment, or access-denied while duplicating the token; also mocked FFI in tests returning FALSE.","commonSituations":"Running Puppet code from minimal service hosts or scheduled-task contexts with unusual token setups; userspace emulation layers; spec environments where CheckTokenMembership is stubbed as failing.","solutions":["Read the Win32 code from the exception (e.code) — ERROR_NO_TOKEN vs ERROR_ACCESS_DENIED point to different fixes.","Run the check from an interactive/elevated context to confirm the environment, then adjust the hosting context for the failing one.","For ERROR_NO_TOKEN, ensure the thread/process actually has a token (not a bare system thread).","In tests, stub CheckTokenMembership to succeed and write TRUE/FALSE into ismember_pointer."],"exampleFix":"# before\nis_admin = Puppet::Util::Windows::User.check_token_membership\n\n# after - degrade gracefully when the token cannot be evaluated\nbegin\n  is_admin = Puppet::Util::Windows::User.check_token_membership\nrescue Puppet::Util::Windows::Error => e\n  Puppet.warning(\"Cannot determine admin status: Win32 #{e.code}\")\n  is_admin = nil\nend","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"begin\n  is_admin = Puppet::Util::Windows::User.check_token_membership\nrescue Puppet::Util::Windows::Error => e\n  case e.code\n  when 1008 # ERROR_NO_TOKEN: no effective token in this context\n    is_admin = nil\n  else raise\n  end\nend","preventionTips":["Do not call check_token_membership from bare system threads or token-less hosts.","Distinguish 'check failed' from 'not elevated' in all callers.","Make FFI stubs return TRUE and populate the out boolean in tests."],"tags":["windows","security","access-token","elevation","puppet"],"backgroundTag":"token-membership-check-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}