{"record":{"id":"fa4e274fef8abf89","repo":"puppetlabs/puppet","slug":"failed-to-create-administrators-sid","errorCode":null,"errorMessage":"Failed to create administrators SID","messagePattern":"Failed to create administrators SID","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/user.rb","lineNumber":55,"sourceCode":"  # https://msdn.microsoft.com/en-us/library/windows/desktop/ee207397(v=vs.85).aspx\n  SECURITY_MAX_SID_SIZE = 68\n\n  # https://msdn.microsoft.com/en-us/library/windows/desktop/ms681385(v=vs.85).aspx\n  # These error codes indicate successful authentication but failure to\n  # logon for a separate reason\n  ERROR_ACCOUNT_RESTRICTION = 1327\n  ERROR_INVALID_LOGON_HOURS = 1328\n  ERROR_INVALID_WORKSTATION = 1329\n  ERROR_ACCOUNT_DISABLED    = 1331\n\n  def check_token_membership\n    is_admin = false\n    FFI::MemoryPointer.new(:byte, SECURITY_MAX_SID_SIZE) do |sid_pointer|\n      FFI::MemoryPointer.new(:dword, 1) do |size_pointer|\n        size_pointer.write_uint32(SECURITY_MAX_SID_SIZE)\n\n        if CreateWellKnownSid(:WinBuiltinAdministratorsSid, FFI::Pointer::NULL, sid_pointer, size_pointer) == FFI::WIN32_FALSE\n          raise Puppet::Util::Windows::Error, _(\"Failed to create administrators SID\")\n        end\n      end\n\n      if IsValidSid(sid_pointer) == FFI::WIN32_FALSE\n        raise Puppet::Util::Windows::Error, _(\"Invalid SID\")\n      end\n\n      FFI::MemoryPointer.new(:win32_bool, 1) do |ismember_pointer|\n        if CheckTokenMembership(FFI::Pointer::NULL_HANDLE, sid_pointer, ismember_pointer) == FFI::WIN32_FALSE\n          raise Puppet::Util::Windows::Error, _(\"Failed to check membership\")\n        end\n\n        # Is administrators SID enabled in calling thread's access token?\n        is_admin = ismember_pointer.read_win32_bool\n      end\n    end\n\n    is_admin","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/user.rb#L37-L73","documentation":"Raised by Puppet::Util::Windows::User.check_token_membership when CreateWellKnownSid fails to build the well-known administrators SID (WinBuiltinAdministratorsSid, S-1-5-32-544) into a preallocated SECURITY_MAX_SID_SIZE buffer. This is the first step of determining whether the current process token is elevated/admin. Because the arguments are constants, a failure indicates an environment-level problem, not caller misuse.","triggerScenarios":"advapi32 CreateWellKnownSid failing: ERROR_INVALID_PARAMETER from an unsupported WellKnownSidType on a down-level OS, memory pressure preventing the (already-buffered) call, or a stripped/broken advapi32 in unusual Windows variants.","commonSituations":"Practically unseen on stock Windows; occasionally surfaced in test environments with mocked FFI functions, on Wine/Windows-emulation layers, or when native memory corruption is present. Worth treating as 'cannot determine admin status' rather than 'not admin'.","solutions":["Treat the failure as 'unknown admin status' in callers rather than 'not elevated' and surface it to the operator.","Restart the process/machine if native memory issues are suspected.","If on a non-standard Windows implementation, verify advapi32 exports with a minimal repro script.","In tests, stub CreateWellKnownSid to return WIN32_TRUE with the pointer populated."],"exampleFix":"// exampleFix not applicable - environment-level failure\nnull","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"begin\n  admin = Puppet::Util::Windows::User.check_token_membership\nrescue Puppet::Util::Windows::Error => e\n  raise unless e.message.include?('Failed to create administrators SID')\n  admin = nil # unknown, not false\n  Puppet.warning(\"could not build admins SID: Win32 #{e.code}\")\nend","preventionTips":["Treat check_token_membership failures as 'unknown elevation', never as 'not admin'.","Keep the agent on supported, unmodified Windows builds.","Stub CreateWellKnownSid truthfully in specs."],"tags":["windows","sid","well-known-sid","advapi32","puppet"],"backgroundTag":"well-known-sid-creation-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}