puppetlabs/puppet · error · Puppet::Error

"#{@normalized_logon_account}" is missing the 'Log On As A S

Error message

"#{@normalized_logon_account}" is missing the 'Log On As A Service' right.

What it means

Raised by Puppet's Windows service provider when the logon account's rights string is non-nil but lacks SeServiceLogonRight — the account does not hold the 'Log On As A Service' right. (A nil rights string passes, representing unresolvable/no explicit assignment.) The check runs in validate_logon_credentials before Puppet reconfigures the service to run as this account.

Source

Thrown at lib/puppet/provider/service/windows.rb:171

  def normalize_logonaccount
    logon_account = @resource[:logonaccount].sub(/^\.\\/, "#{Puppet::Util::Windows::ADSI.computer_name}\\")
    return 'LocalSystem' if Puppet::Util::Windows::User.localsystem?(logon_account)

    @logonaccount_information ||= Puppet::Util::Windows::SID.name_to_principal(logon_account)
    return logon_account unless @logonaccount_information
    return ".\\#{@logonaccount_information.account}" if @logonaccount_information.domain == Puppet::Util::Windows::ADSI.computer_name

    @logonaccount_information.domain_account
  end

  def validate_logon_credentials
    unless Puppet::Util::Windows::User.localsystem?(@normalized_logon_account)
      raise Puppet::Error, "\"#{@normalized_logon_account}\" is not a valid account" unless @logonaccount_information && [:SidTypeUser, :SidTypeWellKnownGroup].include?(@logonaccount_information.account_type)

      user_rights = Puppet::Util::Windows::User.get_rights(@logonaccount_information.domain_account) unless Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account)
      raise Puppet::Error, "\"#{@normalized_logon_account}\" has the 'Log On As A Service' right set to denied." if user_rights =~ /SeDenyServiceLogonRight/
      raise Puppet::Error, "\"#{@normalized_logon_account}\" is missing the 'Log On As A Service' right." unless user_rights.nil? || user_rights =~ /SeServiceLogonRight/
    end

    is_a_predefined_local_account = Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account) || @normalized_logon_account == 'LocalSystem'
    account_info = @normalized_logon_account.split("\\")
    able_to_logon = Puppet::Util::Windows::User.password_is?(account_info[1], @resource[:logonpassword], account_info[0]) unless is_a_predefined_local_account
    raise Puppet::Error, "The given password is invalid for user '#{@normalized_logon_account}'." unless is_a_predefined_local_account || able_to_logon
  end
end

View on GitHub (pinned to e227c27540)

Solutions

1. Grant the right via Local Security Policy (secpol.msc > Local Policies > User Rights Assignment > 'Log on as a service') or preferably via GPO so it is reproducible.
2. Automate the grant with a tool such as the puppet-local_security_policy module or a DSC resource instead of manual clicks.
3. Verify effective policy after `gpupdate /force`: export with `secedit /export /cfg p.cfg` and confirm the account appears under SeServiceLogonRight.
4. If a domain GPO overwrites local grants, add the account to the GPO's list rather than setting it locally.

rights = Puppet::Util::Windows::User.get_rights('DOMAIN\\svc_myapp')
raise 'missing Log On As A Service right' unless rights.nil? || rights =~ /SeServiceLogonRight/

def service_logon_granted?(domain_account)
  rights = Puppet::Util::Windows::User.get_rights(domain_account)
  rights.nil? || rights =~ /SeServiceLogonRight/
end

When it happens

Trigger: Setting `logonaccount`/`logonpassword` on a Windows service for an account that exists and is a valid user type, but was never granted the right via Local Security Policy, GPO, or installer.

Common situations: Freshly created service accounts without the right; right previously granted only on another machine; GPO that defines 'Log On As A Service' explicitly and does not include the new account, overwriting local grants.

Related errors

• "#{@normalized_logon_account}" has the 'Log On As A Service'
• "#{@normalized_logon_account}" is not a valid account
• The given password is invalid for user '#{@normalized_logon_
• Calling `#{method_name}` returned 'Win32 Error Code 0x%08X'.
• RegisterEventSourceW failed to open Windows eventlog

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/294dcdfabe028973. Report an issue: GitHub.