puppetlabs/puppet · error · Puppet::Error

Calling `#{method_name}` returned 'Win32 Error Code 0x%08X'.

Error message

Calling `#{method_name}` returned 'Win32 Error Code 0x%08X'. #{error_reason}

What it means

Raised by check_lsa_nt_status_and_raise_failures — the shared checker for the LSA (Local Security Authority) calls used by get_rights, set_rights, remove_rights and the LsaOpenPolicy/LsaClose/LsaFreeMemory plumbing. It converts the NTSTATUS to a Win32 code via LsaNtStatusToWinError and prints it in hex with a friendly reason for the common cases: 0x5 access denied (run as administrator), 0x521 no such privilege (bad right name), 0x6ba RPC server unavailable (domain/DC unreachable). Success (0x0) and ERROR_FILE_NOT_FOUND (0x2, 'no rights assigned') return quietly; unmapped codes raise with an empty reason.

Source

Thrown at lib/puppet/util/windows/user.rb:261

  # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/18d8fbe8-a967-4f1c-ae50-99ca8e491d2d
  def self.check_lsa_nt_status_and_raise_failures(status, method_name)
    error_code = LsaNtStatusToWinError(status)

    error_reason = case error_code.to_s(16)
                   when '0' # ERROR_SUCCESS
                     return # Method call succeded
                   when '2' # ERROR_FILE_NOT_FOUND
                     return # No rights/privilleges assigned to given user
                   when '5' # ERROR_ACCESS_DENIED
                     "Access is denied. Please make sure that puppet is running as administrator."
                   when '521' # ERROR_NO_SUCH_PRIVILEGE
                     "One or more of the given rights/privilleges are incorrect."
                   when '6ba' # RPC_S_SERVER_UNAVAILABLE
                     "The RPC server is unavailable or given domain name is invalid."
                   end

    raise Puppet::Error, "Calling `#{method_name}` returned 'Win32 Error Code 0x%08X'. #{error_reason}" % error_code
  end
  private_class_method :check_lsa_nt_status_and_raise_failures

  ffi_convention :stdcall

  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx
  # BOOL LogonUser(
  #   _In_      LPTSTR lpszUsername,
  #   _In_opt_  LPTSTR lpszDomain,
  #   _In_opt_  LPTSTR lpszPassword,
  #   _In_      DWORD dwLogonType,
  #   _In_      DWORD dwLogonProvider,
  #   _Out_     PHANDLE phToken
  # );
  ffi_lib :advapi32
  attach_function_private :LogonUserW,
                          [:lpwstr, :lpwstr, :lpwstr, :dword, :dword, :phandle], :win32_bool

View on GitHub (pinned to e227c27540)

Solutions

Run Puppet elevated as Administrator — 0x5 access denied is by far the most common trigger for LSA policy writes.
Verify privilege names against the documented Se* list (e.g. SeServiceLogonRight, SeBatchLogonRight) — 0x521 means one of them is wrong.
For 0x6ba on domain-joined hosts, restore DC connectivity (VPN/network) or target the local SAM account form 'DOMAIN\\user' vs '.\\user' correctly.
Confirm the account exists first: Puppet::Util::Windows::SID.name_to_principal(name) returning nil will cause set_rights/remove_rights to blow up before/around the LSA call.
For unmapped codes (no reason text), decode the hex value against the MS-ERREF/NTSTATUS docs to identify the failing LSA call (method_name in the message says which API).

Example fix

# before
Puppet::Util::Windows::User.set_rights('svc_app', ['SeServiceLogonRite']) # typo
# -> Calling `LsaAddAccountRights` returned 'Win32 Error Code 0x00000521...'

# after
Puppet::Util::Windows::User.set_rights('svc_app', ['SeServiceLogonRight'])

Defensive patterns

Strategy: try-catch

Validate before calling

# resolve the account and validate right names before touching LSA
principal = Puppet::Util::Windows::SID.name_to_principal(name.sub(/^\.\\/, "#{Puppet::Util::Windows::ADSI.computer_name}\\"))
raise ArgumentError, "cannot resolve account #{name}" unless principal

KNOWN_RIGHTS = %w[SeServiceLogonRight SeBatchLogonRight SeInteractiveLogonRight SeNetworkLogonRight SeDenyRemoteInteractiveLogonRight ...]
bad = rights - KNOWN_RIGHTS
raise ArgumentError, "unknown privileges: #{bad.join(', ')}" unless bad.empty?

Try / catch

begin
  Puppet::Util::Windows::User.set_rights(name, rights)
rescue Puppet::Error => e
  msg = e.message
  raise unless msg.include?('Win32 Error Code')
  case msg
  when /0x00000005/ then raise 'run Puppet elevated: LSA access denied'
  when /0x00000521/ then raise "misspelled privilege in #{rights.inspect}"
  when /0x000006ba/ then raise 'domain controller unreachable (RPC)'
  else raise
  end
end

Prevention

Run privilege/rights management elevated — LSA policy writes require administrator.
Maintain a validated list of Se* privilege names and lint manifests against it.
Resolve account names to principals before set/remove_rights to avoid nil-SID paths.
On domain-joined hosts, verify DC reachability before rights changes that touch domain accounts.

When it happens

Trigger: Managing privileges/rights via set_rights/remove_rights without elevation -> LsaOpenPolicy or LsaAddAccountRights returns STATUS_ACCESS_DENIED (maps to 0x5); a misspelled privilege like 'SeServiceLogonRite' -> ERROR_NO_SUCH_PRIVILEGE (0x521); domain-joined machine cannot reach a DC -> RPC_S_SERVER_UNAVAILABLE (0x6ba); the account name not resolving so a nil/garbage SID is passed; LsaFreeMemory/LsaClose failures from corrupted handles.

Common situations: user_rights (or custom rbac) manifests applied by a non-elevated Puppet agent; privilege names with wrong casing or typos in YAML/manifest data; laptops away from the network managing domain accounts; accounts renamed/deleted between compile and apply; code assuming error_reason is always set — unmapped codes print 'Win32 Error Code 0x...' with no reason text.

Related errors

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/64aaf226450612db. Report an issue: GitHub.