{"record":{"id":"aad0e659949a169b","repo":"puppetlabs/puppet","slug":"the-logonaccount-parameter-is-mandatory-when-set","errorCode":null,"errorMessage":"The 'logonaccount' parameter is mandatory when setting 'logonpassword'.","messagePattern":"The 'logonaccount' parameter is mandatory when setting 'logonpassword'\\.","errorType":"validation","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/type/service.rb","lineNumber":306,"sourceCode":"\n    # Basically just a synonym for restarting.  Used to respond\n    # to events.\n    def refresh\n      # Only restart if we're actually running\n      if (@parameters[:ensure] || newattr(:ensure)).retrieve == :running\n        provider.restart\n      else\n        debug \"Skipping restart; service is not running\"\n      end\n    end\n\n    def self.needs_ensure_retrieved\n      false\n    end\n\n    validate do\n      if @parameters[:logonpassword] && @parameters[:logonaccount].nil?\n        raise Puppet::Error, _(\"The 'logonaccount' parameter is mandatory when setting 'logonpassword'.\")\n      end\n    end\n  end\nend\n","sourceCodeStart":288,"sourceCodeEnd":311,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/type/service.rb#L288-L311","documentation":"The service type's resource-level validate raises Puppet::Error when `logonpassword` is set without `logonaccount` (lib/puppet/type/service.rb:306): a logon password is meaningless without the account it authenticates. logonpassword defaults to '' only when logonaccount is present.","triggerScenarios":"`service { 'svc': logonpassword => 'secret' }` with no logonaccount; profiles that set the password from Hiera while the account is optional/undef for some nodes.","commonSituations":"Wrapper classes with optional credentials where only the password key exists in Hiera; refactors splitting credential parameters; typos in the logonaccount key name.","solutions":["Add `logonaccount` (e.g. '.\\\\svc_user' or 'DOMAIN\\\\user') alongside logonpassword","Or remove logonpassword if you do not manage Windows logon credentials","In wrappers, set both from the same Hiera namespace and fail together if incomplete"],"exampleFix":"# before\nservice { 'mysvc':\n  ensure        => running,\n  logonpassword => 'P@ssw0rd',\n}\n\n# after\nservice { 'mysvc':\n  ensure        => running,\n  logonaccount  => '.\\\\svc_user',\n  logonpassword => 'P@ssw0rd',\n}","handlingStrategy":"validation","validationCode":"if $logonpassword != undef and $logonaccount == undef {\n  fail('logonaccount is required when logonpassword is set')\n}","typeGuard":"def credentials_complete?(params)\n  params[:logonpassword].nil? || !params[:logonaccount].nil?\nend","tryCatchPattern":"begin\n  Puppet::Type.type(:service).new(name: 'svc', logonpassword: 'secret')\nrescue Puppet::Error => e\n  raise unless e.message.include?('logonaccount')\n  # supply logonaccount or drop the password\nend","preventionTips":["Keep credential keys paired in Hiera (set both or neither)","Use identical lookup keys for account/password in wrappers","Windows service examples in module READMEs should always show both"],"tags":["puppet","windows","service","credentials"],"backgroundTag":"missing-required-parameter","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}