{"record":{"id":"dd125448c8ead4b4","repo":"puppetlabs/puppet","slug":"failed-to-logon-user-name","errorCode":null,"errorMessage":"Failed to logon user %{name}","messagePattern":"Failed to logon user %(.+?)","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/user.rb","lineNumber":102,"sourceCode":"      ERROR_ACCOUNT_DISABLED,\n    ]\n\n    authenticated_error_codes.include?(detail.code)\n  end\n  module_function :password_is?\n\n  def logon_user(name, password, domain = '.', &block)\n    fLOGON32_PROVIDER_DEFAULT = 0\n    fLOGON32_LOGON_INTERACTIVE = 2\n    fLOGON32_LOGON_NETWORK = 3\n\n    token = nil\n    begin\n      FFI::MemoryPointer.new(:handle, 1) do |token_pointer|\n        # try logon using network else try logon using interactive mode\n        if logon_user_by_logon_type(name, domain, password, fLOGON32_LOGON_NETWORK, fLOGON32_PROVIDER_DEFAULT, token_pointer) == FFI::WIN32_FALSE\n          if logon_user_by_logon_type(name, domain, password, fLOGON32_LOGON_INTERACTIVE, fLOGON32_PROVIDER_DEFAULT, token_pointer) == FFI::WIN32_FALSE\n            raise Puppet::Util::Windows::Error, _(\"Failed to logon user %{name}\") % { name: name.inspect }\n          end\n        end\n\n        yield token = token_pointer.read_handle\n      end\n    ensure\n      FFI::WIN32.CloseHandle(token) if token\n    end\n\n    # token has been closed by this point\n    true\n  end\n  module_function :logon_user\n\n  def self.logon_user_by_logon_type(name, domain, password, logon_type, logon_provider, token)\n    LogonUserW(wide_string(name), wide_string(domain), password.nil? ? FFI::Pointer::NULL : wide_string(password), logon_type, logon_provider, token)\n  end\n","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/user.rb#L84-L120","documentation":"Raised by Puppet::Util::Windows::User.logon_user when LogonUserW fails in both NETWORK (fLOGON32_LOGON_NETWORK) and INTERACTIVE (fLOGON32_LOGON_INTERACTIVE) logon types — the code tries network first and falls back to interactive before giving up. The message embeds name.inspect and Puppet::Util::Windows::Error appends the Win32 reason. The module also defines logon-specific codes (ERROR_ACCOUNT_RESTRICTION 1327, ERROR_INVALID_LOGON_HOURS 1328, ERROR_INVALID_WORKSTATION 1329, ERROR_ACCOUNT_DISABLED 1331) which password_is? interprets as 'wrong password'.","triggerScenarios":"Wrong username/password (ERROR_LOGON_FAILURE 1326); account disabled (1331); restricted logon hours (1328); workstation restriction (1329); expired password; missing 'Log on as a batch/service' right (ERROR_LOGON_TYPE_NOT_GRANTED 1385) for the interactive fallback; machine account vs domain account confusion in the domain argument.","commonSituations":"User resource with an invalid password in the manifest (typo, special-character escaping); managing a domain user while the DC rejects the credentials; accounts created by Puppet that are disabled by policy; password contains characters mangled by manifest escaping; user lacks rights when Puppet later calls LogonUser to load the profile.","solutions":["Verify the credentials manually: `runas /user:<domain>\\<name> cmd` or PowerShell to confirm the password works.","Check the Win32 code in the error (e.code): 1326 bad password, 1331 disabled, 1327/1328/1329 policy restrictions, 1385 missing logon right.","Fix escaping of special characters in the manifest password (quotes, backslashes, $).","Grant the needed logon right (e.g. SeServiceLogonRight / SeInteractiveLogonRight) via user_rights management or Local Security Policy.","Confirm the domain argument: '.' for local accounts, correct NETBIOS/FQDN for domain accounts."],"exampleFix":"# before\nPuppet::Util::Windows::User.logon_user(name, password) { |token| ... } # raises on bad creds\n\n# after - classify the failure instead of a generic crash\nbegin\n  Puppet::Util::Windows::User.logon_user(name, password) { |token| ... }\nrescue Puppet::Util::Windows::Error => e\n  case e.code\n  when 1326 then raise ArgumentError, 'invalid credentials'\n  when 1331 then raise ArgumentError, 'account disabled'\n  else raise\n  end\nend","handlingStrategy":"try-catch","validationCode":"# pre-flight the credentials before logon-dependent work\n# (cheap check: resolve the account, then rely on one controlled attempt)\nprincipal = Puppet::Util::Windows::SID.name_to_principal(\"#{domain}\\\\#{name}\")\nraise ArgumentError, \"account #{name} does not exist\" unless principal","typeGuard":null,"tryCatchPattern":"begin\n  Puppet::Util::Windows::User.logon_user(name, password, domain) { |t| ... }\nrescue Puppet::Util::Windows::Error => e\n  case e.code\n  when 1326 then raise ArgumentError, 'bad username or password'\n  when 1327, 1328, 1329, 1331 then raise ArgumentError, \"account restriction: Win32 #{e.code}\"\n  when 1385 then raise 'grant SeInteractiveLogonRight/SeServiceLogonRight first'\n  else raise\n  end\nend","preventionTips":["Test credentials interactively (runas) before encoding them in automation.","Escape special characters correctly in manifest passwords; avoid trailing whitespace/newlines from heredocs.","Grant the required logon rights before managing profile/logon-dependent resources.","Use '.\\\\user' for local accounts and the real domain prefix for domain accounts."],"tags":["windows","logon","authentication","win32","credentials","puppet"],"backgroundTag":"windows-logon-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}