What causes "LookupPrivilegeValue(#{system_name}, #{name}, #{luid_ptr})" in puppetlabs/puppet?

Use exact names from the Windows Privilege Constants documentation — 'SeDebugPrivilege', 'SeSecurityPrivilege', 'SeBackupPrivilege' — and check spelling first.

puppetlabs/puppet · error · Puppet::Util::Windows::Error

LookupPrivilegeValue(#{system_name}, #{name}, #{luid_ptr})

Error message

LookupPrivilegeValue(#{system_name}, #{name}, #{luid_ptr})

What it means

Raised by Process.lookup_privilege_value (lib/puppet/util/windows/process.rb:158) when LookupPrivilegeValueW cannot turn a privilege display name into a LUID — the name does not exist on the target system, or system_name could not be contacted. Puppet resolves names like SeDebugPrivilege here before enabling them via Security.with_privilege. ERROR_NO_SUCH_PRIVILEGE (1313) is the expected code; Puppet itself special-cases it for SeCreateSymbolicLinkPrivilege on pre-Vista hosts in process_privilege_symlink?.

Source

Thrown at lib/puppet/util/windows/process.rb:158

          end
        end
      end
    end

    image_name
  end
  module_function :get_process_image_name_by_pid

  def lookup_privilege_value(name, system_name = '', &block)
    FFI::MemoryPointer.new(LUID.size) do |luid_ptr|
      result = LookupPrivilegeValueW(
        wide_string(system_name),
        wide_string(name.to_s),
        luid_ptr
      )

      if result == FFI::WIN32_FALSE
        raise Puppet::Util::Windows::Error, "LookupPrivilegeValue(#{system_name}, #{name}, #{luid_ptr})"
      end

      yield LUID.new(luid_ptr)
    end

    # the underlying MemoryPointer for LUID is cleaned up by this point
    nil
  end
  module_function :lookup_privilege_value

  def get_token_information(token_handle, token_information, &block)
    # to determine buffer size
    FFI::MemoryPointer.new(:dword, 1) do |return_length_ptr|
      result = GetTokenInformation(token_handle, token_information, nil, 0, return_length_ptr)
      return_length = return_length_ptr.read_dword

      if return_length <= 0
        raise Puppet::Util::Windows::Error, "GetTokenInformation(#{token_handle}, #{token_information}, nil, 0, #{return_length_ptr})"

View on GitHub (pinned to e227c27540)

Solutions

Use exact names from the Windows Privilege Constants documentation — 'SeDebugPrivilege', 'SeSecurityPrivilege', 'SeBackupPrivilege' — and check spelling first.
Confirm the privilege exists on the host: run whoami /priv (for held privileges) or inspect the local security policy.
Leave system_name as '' (local) unless you specifically need a remote LUID.
Rescue and treat e.code == 1313 (ERROR_NO_SUCH_PRIVILEGE) as 'not supported here' — skip gracefully the way process_privilege_symlink? does.

Example fix

# before — typo'd name never resolves
Process.lookup_privilege_value('SeDebugPriviledge') { |luid| use(luid) }

# after — exact name, graceful skip on unsupported hosts
begin
  Process.lookup_privilege_value('SeDebugPrivilege') { |luid| use(luid) }
rescue Puppet::Util::Windows::Error => e
  raise unless e.code == 1313 # ERROR_NO_SUCH_PRIVILEGE
end

Defensive patterns

Strategy: validation

Validate before calling

KNOWN_PRIVILEGES = %w[SeDebugPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeBackupPrivilege
                  SeRestorePrivilege SeImpersonatePrivilege SeCreateSymbolicLinkPrivilege].freeze
raise ArgumentError, "unknown privilege #{name.inspect}" unless KNOWN_PRIVILEGES.include?(name)
Process.lookup_privilege_value(name) { |luid| use(luid) }

Try / catch

begin
  Process.lookup_privilege_value(name) { |luid| yield luid }
rescue Puppet::Util::Windows::Error => e
  raise unless e.code == 1313 # ERROR_NO_SUCH_PRIVILEGE — not on this host
  Puppet.debug "privilege #{name} unavailable; skipping"
end

Prevention

Copy privilege names verbatim from the Windows Privilege Constants docs — they are literal strings, not symbols
Confirm availability with whoami /priv or secpol.msc on the target SKU
Handle code 1313 explicitly for OS version differences instead of failing hard

When it happens

Trigger: A typo'd privilege string such as 'SeDebugPriviledge'; a privilege not defined on this Windows SKU or edition (some exist only on Domain Controllers); system_name pointing at an unreachable or decommissioned host; pre-Vista systems lacking newer privileges.

Common situations: Hardcoded privilege names in custom elevation code; privilege constants copied from newer SDK docs onto older hosts; remote system_name values that no longer resolve.

Related errors

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/2ce7c00225370d52. Report an issue: GitHub.