{"record":{"id":"cb7c442f959c2ee3","repo":"puppetlabs/puppet","slug":"failed-to-update-service-configuration","errorCode":null,"errorMessage":"Failed to update service configuration","messagePattern":"Failed to update service configuration","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/service.rb","lineNumber":193,"sourceCode":"      options[:logon_account] = wide_string(options[:logon_account]) || FFI::Pointer::NULL\n      options[:logon_password] = wide_string(options[:logon_password]) || FFI::Pointer::NULL\n\n      open_service(service_name, SC_MANAGER_CONNECT, SERVICE_CHANGE_CONFIG) do |service|\n        success = ChangeServiceConfigW(\n          service,\n          SERVICE_NO_CHANGE,        # dwServiceType\n          options[:startup_type],   # dwStartType\n          SERVICE_NO_CHANGE,        # dwErrorControl\n          FFI::Pointer::NULL,       # lpBinaryPathName\n          FFI::Pointer::NULL,       # lpLoadOrderGroup\n          FFI::Pointer::NULL,       # lpdwTagId\n          FFI::Pointer::NULL,       # lpDependencies\n          options[:logon_account],  # lpServiceStartName\n          options[:logon_password], # lpPassword\n          FFI::Pointer::NULL        # lpDisplayName\n        )\n        if success == FFI::WIN32_FALSE\n          raise Puppet::Util::Windows::Error, _(\"Failed to update service configuration\")\n        end\n      end\n\n      if options[:startup_type]\n        options[:delayed] ||= false\n        set_startup_mode_delayed(service_name, options[:delayed])\n      end\n    end\n    module_function :set_startup_configuration\n\n    # enumerate over all services in all states and return them as a hash\n    #\n    # @return [Hash] a hash containing services:\n    #   { 'service name' => {\n    #                         'display_name' => 'display name',\n    #                         'service_status_process' => SERVICE_STATUS_PROCESS struct\n    #                       }\n    #   }","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/service.rb#L175-L211","documentation":"Raised by set_startup_configuration when ChangeServiceConfigW returns FALSE. Puppet calls it to change startup type, logon account, and logon password (everything else is SERVICE_NO_CHANGE / NULL). Typical Win32 causes are an invalid logon account or password (ERROR_INVALID_SERVICE_ACCOUNT), access denied because the handle was not opened with SERVICE_CHANGE_CONFIG, or an invalid start type value.","triggerScenarios":"set_startup_configuration with options[:logon_account]/options[:logon_password] that do not match a valid credentials pair; a startup_type symbol not in SERVICE_START_TYPES (line 174 maps unknown symbols to SERVICE_NO_CHANGE, so type errors silently pass through); insufficient privileges on the service.","commonSituations":"Manifest changes a service's logon account with a wrong or expired password; account name given without the DOMAIN\\\\ prefix or '.\\\\' for local accounts; managed service accounts misconfigured; agent running without rights to reconfigure the service.","solutions":["Check e.code: 1057 = invalid account name, 1064 = logon failure for the given account/password pair, 5 = access denied","Supply logon_account as DOMAIN\\\\user or .\\\\user for local accounts, and the exact password","Verify the account's 'Log on as a service' right is granted","Run elevated so the service handle carries SERVICE_CHANGE_CONFIG"],"exampleFix":"// before\nset_startup_configuration('myservice', startup_type: :SERVICE_AUTO_START, logon_account: 'svc_user', logon_password: pw)\n\n# after\nset_startup_configuration('myservice', startup_type: :SERVICE_AUTO_START, logon_account: '.\\\\svc_user', logon_password: pw)","handlingStrategy":"validation","validationCode":"account = options[:logon_account]\nraise Puppet::Error, 'use DOMAIN\\\\user or .\\\\user' if account && !account.include?('\\\\')\n# verify the pair actually authenticates before touching the service\nsid = Puppet::Util::Windows::SID.name_to_sid(account)\nraise Puppet::Error, \"unknown logon account #{account}\" if sid.nil?","typeGuard":null,"tryCatchPattern":"begin\n  Puppet::Util::Windows::Service.set_startup_configuration(name, options)\nrescue Puppet::Util::Windows::Error => e\n  raise Puppet::Error, \"Bad logon account/password (code #{e.code})\" if [1057, 1064, 1334].include?(e.code)\n  raise Puppet::Error, \"No SERVICE_CHANGE_CONFIG on #{name}; elevate\" if e.code == 5\n  raise\nend","preventionTips":["Always qualify logon accounts as DOMAIN\\\\user or .\\\\user","Verify credentials and 'Log on as a service' right before applying them to a service","Run config changes elevated so the handle carries SERVICE_CHANGE_CONFIG"],"tags":["windows","service","win32","service-config","logon-account"],"backgroundTag":"windows-service-config-update-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}