puppetlabs/puppet · error · Puppet::Util::Windows::Error

Failed to update service configuration

Error message

Failed to update service configuration

What it means

Raised by set_startup_configuration when ChangeServiceConfigW returns FALSE. Puppet calls it to change startup type, logon account, and logon password (everything else is SERVICE_NO_CHANGE / NULL). Typical Win32 causes are an invalid logon account or password (ERROR_INVALID_SERVICE_ACCOUNT), access denied because the handle was not opened with SERVICE_CHANGE_CONFIG, or an invalid start type value.

Source

Thrown at lib/puppet/util/windows/service.rb:193

      options[:logon_account] = wide_string(options[:logon_account]) || FFI::Pointer::NULL
      options[:logon_password] = wide_string(options[:logon_password]) || FFI::Pointer::NULL

      open_service(service_name, SC_MANAGER_CONNECT, SERVICE_CHANGE_CONFIG) do |service|
        success = ChangeServiceConfigW(
          service,
          SERVICE_NO_CHANGE,        # dwServiceType
          options[:startup_type],   # dwStartType
          SERVICE_NO_CHANGE,        # dwErrorControl
          FFI::Pointer::NULL,       # lpBinaryPathName
          FFI::Pointer::NULL,       # lpLoadOrderGroup
          FFI::Pointer::NULL,       # lpdwTagId
          FFI::Pointer::NULL,       # lpDependencies
          options[:logon_account],  # lpServiceStartName
          options[:logon_password], # lpPassword
          FFI::Pointer::NULL        # lpDisplayName
        )
        if success == FFI::WIN32_FALSE
          raise Puppet::Util::Windows::Error, _("Failed to update service configuration")
        end
      end

      if options[:startup_type]
        options[:delayed] ||= false
        set_startup_mode_delayed(service_name, options[:delayed])
      end
    end
    module_function :set_startup_configuration

    # enumerate over all services in all states and return them as a hash
    #
    # @return [Hash] a hash containing services:
    #   { 'service name' => {
    #                         'display_name' => 'display name',
    #                         'service_status_process' => SERVICE_STATUS_PROCESS struct
    #                       }
    #   }

View on GitHub (pinned to e227c27540)

Solutions

1. Check e.code: 1057 = invalid account name, 1064 = logon failure for the given account/password pair, 5 = access denied
2. Supply logon_account as DOMAIN\\user or .\\user for local accounts, and the exact password
3. Verify the account's 'Log on as a service' right is granted
4. Run elevated so the service handle carries SERVICE_CHANGE_CONFIG

Example fix

// before
set_startup_configuration('myservice', startup_type: :SERVICE_AUTO_START, logon_account: 'svc_user', logon_password: pw)

# after
set_startup_configuration('myservice', startup_type: :SERVICE_AUTO_START, logon_account: '.\\svc_user', logon_password: pw)

account = options[:logon_account]
raise Puppet::Error, 'use DOMAIN\\user or .\\user' if account && !account.include?('\\')
# verify the pair actually authenticates before touching the service
sid = Puppet::Util::Windows::SID.name_to_sid(account)
raise Puppet::Error, "unknown logon account #{account}" if sid.nil?

begin
  Puppet::Util::Windows::Service.set_startup_configuration(name, options)
rescue Puppet::Util::Windows::Error => e
  raise Puppet::Error, "Bad logon account/password (code #{e.code})" if [1057, 1064, 1334].include?(e.code)
  raise Puppet::Error, "No SERVICE_CHANGE_CONFIG on #{name}; elevate" if e.code == 5
  raise
end

When it happens

Trigger: set_startup_configuration with options[:logon_account]/options[:logon_password] that do not match a valid credentials pair; a startup_type symbol not in SERVICE_START_TYPES (line 174 maps unknown symbols to SERVICE_NO_CHANGE, so type errors silently pass through); insufficient privileges on the service.

Common situations: Manifest changes a service's logon account with a wrong or expired password; account name given without the DOMAIN\\ prefix or '.\\' for local accounts; managed service accounts misconfigured; agent running without rights to reconfigure the service.

Related errors

• Failed to start the service
• Unknown Service state '%{current_state}' for '%{service_name
• Unknown start type '%{start_type}' for '%{service_name}'
• Failed to fetch services
• Failed to open a handle to the service

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/cb7c442f959c2ee3. Report an issue: GitHub.