peass-ng/PEASS-ng · error · ArgumentException

A valid system account name must be supplied for TaskLogonTy

Error message

A valid system account name must be supplied for TaskLogonType.ServiceAccount. Valid entries are "NT AUTHORITY\SYSTEM", "SYSTEM", "NT AUTHORITY\LOCALSERVICE", or "NT AUTHORITY\NETWORKSERVICE".

What it means

Error "A valid system account name must be supplied for TaskLogonType.ServiceAccount. Valid entries are "NT AUTHORITY\SYSTEM", "SYSTEM", "NT AUTHORITY\LOCALSERVICE", or "NT AUTHORITY\NETWORKSERVICE"." thrown in peass-ng/PEASS-ng.

Source

Thrown at winPEAS/winPEASexe/winPEAS/TaskScheduler/TaskFolder.cs:495

        /// <para>This example registers that same task using a specific username and password along with a security definition.</para>
        /// <code lang="cs"><![CDATA[
        /// TaskService.Instance.RootFolder.RegisterTaskDefinition("TaskName", taskDefinition, TaskCreation.CreateOrUpdate, "userDomain\\userName", "userPassword", TaskLogonType.Password, @"O:BAG:DUD:(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FA;;;BA)(A;;FR;;;BU)");
        /// ]]></code></example>
        public Task RegisterTaskDefinition([NotNull] string path, [NotNull] TaskDefinition definition, TaskCreation createType, string userId, string password = null, TaskLogonType logonType = TaskLogonType.S4U, string sddl = null)
        {
            if (definition.Actions.Count < 1 || definition.Actions.Count > 32)
                throw new ArgumentOutOfRangeException(nameof(definition.Actions), @"A task must be registered with at least one action and no more than 32 actions.");

            userId ??= definition.Principal.Account;
            if (userId == string.Empty) userId = null;
            User user = new User(userId);
            if (v2Folder != null)
            {
                definition.Actions.ConvertUnsupportedActions();
                if (logonType == TaskLogonType.ServiceAccount)
                {
                    if (string.IsNullOrEmpty(userId) || !user.IsServiceAccount)
                        throw new ArgumentException(@"A valid system account name must be supplied for TaskLogonType.ServiceAccount. Valid entries are ""NT AUTHORITY\SYSTEM"", ""SYSTEM"", ""NT AUTHORITY\LOCALSERVICE"", or ""NT AUTHORITY\NETWORKSERVICE"".", nameof(userId));
                    if (password != null)
                        throw new ArgumentException(@"A password cannot be supplied when specifying TaskLogonType.ServiceAccount.", nameof(password));
                }
                /*else if ((LogonType == TaskLogonType.Password || LogonType == TaskLogonType.InteractiveTokenOrPassword ||
					(LogonType == TaskLogonType.S4U && UserId != null && !user.IsCurrent)) && password == null)
				{
					throw new ArgumentException("A password must be supplied when specifying TaskLogonType.Password or TaskLogonType.InteractiveTokenOrPassword or TaskLogonType.S4U from another account.", nameof(password));
				}*/
                else if (logonType == TaskLogonType.Group && password != null)
                {
                    throw new ArgumentException(@"A password cannot be supplied when specifying TaskLogonType.Group.", nameof(password));
                }
                // The following line compensates for an omission in the native library that never actually sets the registration date (thanks ixm7).
                if (definition.RegistrationInfo.Date == DateTime.MinValue) definition.RegistrationInfo.Date = DateTime.Now;
                var iRegTask = v2Folder.RegisterTaskDefinition(path, definition.v2Def, (int)createType, userId ?? user.Name, password, logonType, sddl);
                if (createType == TaskCreation.ValidateOnly && iRegTask == null)
                    return null;
                return Task.CreateTask(TaskService, iRegTask);

View on GitHub (pinned to 53fb989abc)

Solutions

1. Pass one of the accepted system accounts: "NT AUTHORITY\SYSTEM" (or "SYSTEM"), "NT AUTHORITY\LOCALSERVICE", or "NT AUTHORITY\NETWORKSERVICE".
2. Use a different TaskLogonType (e.g. Password or InteractiveToken) when registering under a normal user account.
3. Validate the userId against the known service-account names before calling RegisterTaskDefinition.

When it happens

Trigger: Thrown at winPEAS/winPEASexe/winPEAS/TaskScheduler/TaskFolder.cs:495 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/16e55f783094a3db. Report an issue: GitHub.