{"record":{"id":"66faa3ed723e574c","repo":"puppetlabs/puppet","slug":"normalized-logon-account-has-the-log-on-as","errorCode":null,"errorMessage":"\"#{@normalized_logon_account}\" has the 'Log On As A Service' right set to denied.","messagePattern":"\"#(.+?)\" has the 'Log On As A Service' right set to denied\\.","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/provider/service/windows.rb","lineNumber":170,"sourceCode":"  private\n\n  def normalize_logonaccount\n    logon_account = @resource[:logonaccount].sub(/^\\.\\\\/, \"#{Puppet::Util::Windows::ADSI.computer_name}\\\\\")\n    return 'LocalSystem' if Puppet::Util::Windows::User.localsystem?(logon_account)\n\n    @logonaccount_information ||= Puppet::Util::Windows::SID.name_to_principal(logon_account)\n    return logon_account unless @logonaccount_information\n    return \".\\\\#{@logonaccount_information.account}\" if @logonaccount_information.domain == Puppet::Util::Windows::ADSI.computer_name\n\n    @logonaccount_information.domain_account\n  end\n\n  def validate_logon_credentials\n    unless Puppet::Util::Windows::User.localsystem?(@normalized_logon_account)\n      raise Puppet::Error, \"\\\"#{@normalized_logon_account}\\\" is not a valid account\" unless @logonaccount_information && [:SidTypeUser, :SidTypeWellKnownGroup].include?(@logonaccount_information.account_type)\n\n      user_rights = Puppet::Util::Windows::User.get_rights(@logonaccount_information.domain_account) unless Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account)\n      raise Puppet::Error, \"\\\"#{@normalized_logon_account}\\\" has the 'Log On As A Service' right set to denied.\" if user_rights =~ /SeDenyServiceLogonRight/\n      raise Puppet::Error, \"\\\"#{@normalized_logon_account}\\\" is missing the 'Log On As A Service' right.\" unless user_rights.nil? || user_rights =~ /SeServiceLogonRight/\n    end\n\n    is_a_predefined_local_account = Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account) || @normalized_logon_account == 'LocalSystem'\n    account_info = @normalized_logon_account.split(\"\\\\\")\n    able_to_logon = Puppet::Util::Windows::User.password_is?(account_info[1], @resource[:logonpassword], account_info[0]) unless is_a_predefined_local_account\n    raise Puppet::Error, \"The given password is invalid for user '#{@normalized_logon_account}'.\" unless is_a_predefined_local_account || able_to_logon\n  end\nend\n","sourceCodeStart":152,"sourceCodeEnd":180,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/provider/service/windows.rb#L152-L180","documentation":"Raised by Puppet's Windows service provider when the logon account's effective user rights include SeDenyServiceLogonRight — the account is explicitly denied the 'Log On As A Service' right by local or domain policy. The provider calls Puppet::Util::Windows::User.get_rights on the resolved domain\\account and inspects the returned string before configuring the service.","triggerScenarios":"Setting `logonaccount` (with password) on a Windows service where a GPO or Local Security Policy has the account (or a group containing it, such as Everyone or Guests) listed under 'Deny log on as a service'.","commonSituations":"Hardened baselines deny service logon to broad groups; a service account placed in a restricted group; domain policy updated after the service worked previously; using an account that sits in both allow and deny lists (deny wins).","solutions":["Inspect effective rights on the node: `whoami /user` context aside, export policy with `secedit /export /cfg policy.cfg` and check SeDenyServiceLogonRight for the account.","Remove the account (or its group) from the 'Deny log on as a service' list in Local Security Policy / the offending GPO.","If the deny comes from domain GPO, coordinate with your AD administrators or move the service account out of the denied group.","Alternatively switch the service to an account that is not denied (or LocalSystem) if policy cannot change.","Run `gpupdate /force` after the policy change and re-run Puppet."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"rights = Puppet::Util::Windows::User.get_rights('DOMAIN\\\\svc_myapp')\nraise 'account is DENIED service logon' if rights =~ /SeDenyServiceLogonRight/","typeGuard":"def service_logon_denied?(domain_account)\n  Puppet::Util::Windows::User.get_rights(domain_account).to_s =~ /SeDenyServiceLogonRight/\nend","tryCatchPattern":null,"preventionTips":["Check both allow and deny lists before adopting an account for services.","Exclude service accounts from broad 'Deny log on as a service' GPO groups.","Re-check rights after group-policy changes — deny entries override grants."],"tags":["windows","user-rights","service-account","group-policy","puppet"],"backgroundTag":"logon-as-service-right-denied","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}