puppetlabs/puppet · error · Puppet::Util::Windows::Error

Failed to create administrators SID

Error message

Failed to create administrators SID

What it means

Raised by Puppet::Util::Windows::User.check_token_membership when CreateWellKnownSid fails to build the well-known administrators SID (WinBuiltinAdministratorsSid, S-1-5-32-544) into a preallocated SECURITY_MAX_SID_SIZE buffer. This is the first step of determining whether the current process token is elevated/admin. Because the arguments are constants, a failure indicates an environment-level problem, not caller misuse.

Solutions

1. Treat the failure as 'unknown admin status' in callers rather than 'not elevated' and surface it to the operator.
2. Restart the process/machine if native memory issues are suspected.
3. If on a non-standard Windows implementation, verify advapi32 exports with a minimal repro script.
4. In tests, stub CreateWellKnownSid to return WIN32_TRUE with the pointer populated.

Example fix

// exampleFix not applicable - environment-level failure
null

begin
  admin = Puppet::Util::Windows::User.check_token_membership
rescue Puppet::Util::Windows::Error => e
  raise unless e.message.include?('Failed to create administrators SID')
  admin = nil # unknown, not false
  Puppet.warning("could not build admins SID: Win32 #{e.code}")
end

When it happens

Trigger: advapi32 CreateWellKnownSid failing: ERROR_INVALID_PARAMETER from an unsupported WellKnownSidType on a down-level OS, memory pressure preventing the (already-buffered) call, or a stripped/broken advapi32 in unusual Windows variants.

Common situations: Practically unseen on stock Windows; occasionally surfaced in test environments with mocked FFI functions, on Wine/Windows-emulation layers, or when native memory corruption is present. Worth treating as 'cannot determine admin status' rather than 'not admin'.

Related errors

• Failed to convert binary SID
• ads_object must be an IAdsUser or IAdsGroup instance
• Byte array for lookup_account_sid must not be nil and must…
• ConvertSidToStringSidW failed to allocate buffer for sid
• Could not resolve name

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/fa4e274fef8abf89. Report an issue: GitHub.

Appendix: source

Thrown at lib/puppet/util/windows/user.rb:55

  # https://msdn.microsoft.com/en-us/library/windows/desktop/ee207397(v=vs.85).aspx
  SECURITY_MAX_SID_SIZE = 68

  # https://msdn.microsoft.com/en-us/library/windows/desktop/ms681385(v=vs.85).aspx
  # These error codes indicate successful authentication but failure to
  # logon for a separate reason
  ERROR_ACCOUNT_RESTRICTION = 1327
  ERROR_INVALID_LOGON_HOURS = 1328
  ERROR_INVALID_WORKSTATION = 1329
  ERROR_ACCOUNT_DISABLED    = 1331

  def check_token_membership
    is_admin = false
    FFI::MemoryPointer.new(:byte, SECURITY_MAX_SID_SIZE) do |sid_pointer|
      FFI::MemoryPointer.new(:dword, 1) do |size_pointer|
        size_pointer.write_uint32(SECURITY_MAX_SID_SIZE)

        if CreateWellKnownSid(:WinBuiltinAdministratorsSid, FFI::Pointer::NULL, sid_pointer, size_pointer) == FFI::WIN32_FALSE
          raise Puppet::Util::Windows::Error, _("Failed to create administrators SID")
        end
      end

      if IsValidSid(sid_pointer) == FFI::WIN32_FALSE
        raise Puppet::Util::Windows::Error, _("Invalid SID")
      end

      FFI::MemoryPointer.new(:win32_bool, 1) do |ismember_pointer|
        if CheckTokenMembership(FFI::Pointer::NULL_HANDLE, sid_pointer, ismember_pointer) == FFI::WIN32_FALSE
          raise Puppet::Util::Windows::Error, _("Failed to check membership")
        end

        # Is administrators SID enabled in calling thread's access token?
        is_admin = ismember_pointer.read_win32_bool
      end
    end

    is_admin

View on GitHub (pinned to e227c27540)