puppetlabs/puppet · error · Puppet::Util::Windows::Error

Failed to create administrators SID

Error message

Failed to create administrators SID

What it means

Raised by Puppet::Util::Windows::User.check_token_membership when CreateWellKnownSid fails to build the well-known administrators SID (WinBuiltinAdministratorsSid, S-1-5-32-544) into a preallocated SECURITY_MAX_SID_SIZE buffer. This is the first step of determining whether the current process token is elevated/admin. Because the arguments are constants, a failure indicates an environment-level problem, not caller misuse.

Source

Thrown at lib/puppet/util/windows/user.rb:55

  # https://msdn.microsoft.com/en-us/library/windows/desktop/ee207397(v=vs.85).aspx
  SECURITY_MAX_SID_SIZE = 68

  # https://msdn.microsoft.com/en-us/library/windows/desktop/ms681385(v=vs.85).aspx
  # These error codes indicate successful authentication but failure to
  # logon for a separate reason
  ERROR_ACCOUNT_RESTRICTION = 1327
  ERROR_INVALID_LOGON_HOURS = 1328
  ERROR_INVALID_WORKSTATION = 1329
  ERROR_ACCOUNT_DISABLED    = 1331

  def check_token_membership
    is_admin = false
    FFI::MemoryPointer.new(:byte, SECURITY_MAX_SID_SIZE) do |sid_pointer|
      FFI::MemoryPointer.new(:dword, 1) do |size_pointer|
        size_pointer.write_uint32(SECURITY_MAX_SID_SIZE)

        if CreateWellKnownSid(:WinBuiltinAdministratorsSid, FFI::Pointer::NULL, sid_pointer, size_pointer) == FFI::WIN32_FALSE
          raise Puppet::Util::Windows::Error, _("Failed to create administrators SID")
        end
      end

      if IsValidSid(sid_pointer) == FFI::WIN32_FALSE
        raise Puppet::Util::Windows::Error, _("Invalid SID")
      end

      FFI::MemoryPointer.new(:win32_bool, 1) do |ismember_pointer|
        if CheckTokenMembership(FFI::Pointer::NULL_HANDLE, sid_pointer, ismember_pointer) == FFI::WIN32_FALSE
          raise Puppet::Util::Windows::Error, _("Failed to check membership")
        end

        # Is administrators SID enabled in calling thread's access token?
        is_admin = ismember_pointer.read_win32_bool
      end
    end

    is_admin

View on GitHub (pinned to e227c27540)

Solutions

1. Treat the failure as 'unknown admin status' in callers rather than 'not elevated' and surface it to the operator.
2. Restart the process/machine if native memory issues are suspected.
3. If on a non-standard Windows implementation, verify advapi32 exports with a minimal repro script.
4. In tests, stub CreateWellKnownSid to return WIN32_TRUE with the pointer populated.

Example fix

// exampleFix not applicable - environment-level failure
null

begin
  admin = Puppet::Util::Windows::User.check_token_membership
rescue Puppet::Util::Windows::Error => e
  raise unless e.message.include?('Failed to create administrators SID')
  admin = nil # unknown, not false
  Puppet.warning("could not build admins SID: Win32 #{e.code}")
end

When it happens

Trigger: advapi32 CreateWellKnownSid failing: ERROR_INVALID_PARAMETER from an unsupported WellKnownSidType on a down-level OS, memory pressure preventing the (already-buffered) call, or a stripped/broken advapi32 in unusual Windows variants.

Common situations: Practically unseen on stock Windows; occasionally surfaced in test environments with mocked FFI functions, on Wine/Windows-emulation layers, or when native memory corruption is present. Worth treating as 'cannot determine admin status' rather than 'not admin'.

Related errors

• Failed to convert binary SID
• Could not resolve name: %{name}
• Failed to call LookupAccountNameW with account: %{account_na
• Byte array for lookup_account_sid must not be nil and must b
• Failed to call LookupAccountSidW with bytes: %{sid_bytes}

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/fa4e274fef8abf89. Report an issue: GitHub.