peass-ng/PEASS-ng · error · ArgumentException

A password cannot be supplied when specifying TaskLogonType.

Error message

A password cannot be supplied when specifying TaskLogonType.ServiceAccount.

What it means

Argument-validation guard inside RegisterTaskDefinition: it rejects a registration that passes a non-null password together with TaskLogonType.ServiceAccount. A service account (e.g. SYSTEM, LOCALSERVICE) authenticates by its own identity, so the COM API accepts no credential; supplying one means the caller combined the wrong userId/logonType/password inputs.

Source

Thrown at winPEAS/winPEASexe/winPEAS/TaskScheduler/TaskFolder.cs:497

        /// TaskService.Instance.RootFolder.RegisterTaskDefinition("TaskName", taskDefinition, TaskCreation.CreateOrUpdate, "userDomain\\userName", "userPassword", TaskLogonType.Password, @"O:BAG:DUD:(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FA;;;BA)(A;;FR;;;BU)");
        /// ]]></code></example>
        public Task RegisterTaskDefinition([NotNull] string path, [NotNull] TaskDefinition definition, TaskCreation createType, string userId, string password = null, TaskLogonType logonType = TaskLogonType.S4U, string sddl = null)
        {
            if (definition.Actions.Count < 1 || definition.Actions.Count > 32)
                throw new ArgumentOutOfRangeException(nameof(definition.Actions), @"A task must be registered with at least one action and no more than 32 actions.");

            userId ??= definition.Principal.Account;
            if (userId == string.Empty) userId = null;
            User user = new User(userId);
            if (v2Folder != null)
            {
                definition.Actions.ConvertUnsupportedActions();
                if (logonType == TaskLogonType.ServiceAccount)
                {
                    if (string.IsNullOrEmpty(userId) || !user.IsServiceAccount)
                        throw new ArgumentException(@"A valid system account name must be supplied for TaskLogonType.ServiceAccount. Valid entries are ""NT AUTHORITY\SYSTEM"", ""SYSTEM"", ""NT AUTHORITY\LOCALSERVICE"", or ""NT AUTHORITY\NETWORKSERVICE"".", nameof(userId));
                    if (password != null)
                        throw new ArgumentException(@"A password cannot be supplied when specifying TaskLogonType.ServiceAccount.", nameof(password));
                }
                /*else if ((LogonType == TaskLogonType.Password || LogonType == TaskLogonType.InteractiveTokenOrPassword ||
					(LogonType == TaskLogonType.S4U && UserId != null && !user.IsCurrent)) && password == null)
				{
					throw new ArgumentException("A password must be supplied when specifying TaskLogonType.Password or TaskLogonType.InteractiveTokenOrPassword or TaskLogonType.S4U from another account.", nameof(password));
				}*/
                else if (logonType == TaskLogonType.Group && password != null)
                {
                    throw new ArgumentException(@"A password cannot be supplied when specifying TaskLogonType.Group.", nameof(password));
                }
                // The following line compensates for an omission in the native library that never actually sets the registration date (thanks ixm7).
                if (definition.RegistrationInfo.Date == DateTime.MinValue) definition.RegistrationInfo.Date = DateTime.Now;
                var iRegTask = v2Folder.RegisterTaskDefinition(path, definition.v2Def, (int)createType, userId ?? user.Name, password, logonType, sddl);
                if (createType == TaskCreation.ValidateOnly && iRegTask == null)
                    return null;
                return Task.CreateTask(TaskService, iRegTask);
            }

View on GitHub (pinned to 53fb989abc)

Solutions

1. Pass null (or omit the password argument) when logonType is TaskLogonType.ServiceAccount
2. Use a valid service account name such as SYSTEM, NT AUTHORITY\LOCALSERVICE or NT AUTHORITY\NETWORKSERVICE as the userId and drop the password
3. If a password is genuinely required, switch logonType to TaskLogonType.Password or TaskLogonType.InteractiveTokenOrPassword and supply the matching account

When it happens

Trigger: Thrown at winPEAS/winPEASexe/winPEAS/TaskScheduler/TaskFolder.cs:497 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/a042377829c51b8d. Report an issue: GitHub.