puppetlabs/puppet · error · Puppet::Error

"#{@normalized_logon_account}" has the 'Log On As A Service'

Error message

"#{@normalized_logon_account}" has the 'Log On As A Service' right set to denied.

What it means

Raised by Puppet's Windows service provider when the logon account's effective user rights include SeDenyServiceLogonRight — the account is explicitly denied the 'Log On As A Service' right by local or domain policy. The provider calls Puppet::Util::Windows::User.get_rights on the resolved domain\account and inspects the returned string before configuring the service.

Source

Thrown at lib/puppet/provider/service/windows.rb:170

  private

  def normalize_logonaccount
    logon_account = @resource[:logonaccount].sub(/^\.\\/, "#{Puppet::Util::Windows::ADSI.computer_name}\\")
    return 'LocalSystem' if Puppet::Util::Windows::User.localsystem?(logon_account)

    @logonaccount_information ||= Puppet::Util::Windows::SID.name_to_principal(logon_account)
    return logon_account unless @logonaccount_information
    return ".\\#{@logonaccount_information.account}" if @logonaccount_information.domain == Puppet::Util::Windows::ADSI.computer_name

    @logonaccount_information.domain_account
  end

  def validate_logon_credentials
    unless Puppet::Util::Windows::User.localsystem?(@normalized_logon_account)
      raise Puppet::Error, "\"#{@normalized_logon_account}\" is not a valid account" unless @logonaccount_information && [:SidTypeUser, :SidTypeWellKnownGroup].include?(@logonaccount_information.account_type)

      user_rights = Puppet::Util::Windows::User.get_rights(@logonaccount_information.domain_account) unless Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account)
      raise Puppet::Error, "\"#{@normalized_logon_account}\" has the 'Log On As A Service' right set to denied." if user_rights =~ /SeDenyServiceLogonRight/
      raise Puppet::Error, "\"#{@normalized_logon_account}\" is missing the 'Log On As A Service' right." unless user_rights.nil? || user_rights =~ /SeServiceLogonRight/
    end

    is_a_predefined_local_account = Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account) || @normalized_logon_account == 'LocalSystem'
    account_info = @normalized_logon_account.split("\\")
    able_to_logon = Puppet::Util::Windows::User.password_is?(account_info[1], @resource[:logonpassword], account_info[0]) unless is_a_predefined_local_account
    raise Puppet::Error, "The given password is invalid for user '#{@normalized_logon_account}'." unless is_a_predefined_local_account || able_to_logon
  end
end

View on GitHub (pinned to e227c27540)

Solutions

1. Inspect effective rights on the node: `whoami /user` context aside, export policy with `secedit /export /cfg policy.cfg` and check SeDenyServiceLogonRight for the account.
2. Remove the account (or its group) from the 'Deny log on as a service' list in Local Security Policy / the offending GPO.
3. If the deny comes from domain GPO, coordinate with your AD administrators or move the service account out of the denied group.
4. Alternatively switch the service to an account that is not denied (or LocalSystem) if policy cannot change.
5. Run `gpupdate /force` after the policy change and re-run Puppet.

rights = Puppet::Util::Windows::User.get_rights('DOMAIN\\svc_myapp')
raise 'account is DENIED service logon' if rights =~ /SeDenyServiceLogonRight/

def service_logon_denied?(domain_account)
  Puppet::Util::Windows::User.get_rights(domain_account).to_s =~ /SeDenyServiceLogonRight/
end

When it happens

Trigger: Setting `logonaccount` (with password) on a Windows service where a GPO or Local Security Policy has the account (or a group containing it, such as Everyone or Guests) listed under 'Deny log on as a service'.

Common situations: Hardened baselines deny service logon to broad groups; a service account placed in a restricted group; domain policy updated after the service worked previously; using an account that sits in both allow and deny lists (deny wins).

Related errors

• "#{@normalized_logon_account}" is missing the 'Log On As A S
• "#{@normalized_logon_account}" is not a valid account
• The given password is invalid for user '#{@normalized_logon_
• Calling `#{method_name}` returned 'Win32 Error Code 0x%08X'.
• RegisterEventSourceW failed to open Windows eventlog

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/66faa3ed723e574c. Report an issue: GitHub.