puppetlabs/puppet · error · Puppet::Error

"#{@normalized_logon_account}" is not a valid account

Error message

"#{@normalized_logon_account}" is not a valid account

What it means

Raised by Puppet's Windows service provider while validating `logonaccount`: the account name could not be resolved to a principal (Puppet::Util::Windows::SID.name_to_principal returned nil), or the resolved principal is not of type SidTypeUser or SidTypeWellKnownGroup (e.g., it is a domain group or computer account). Part of validate_logon_credentials, run before setting service logon credentials.

Source

Thrown at lib/puppet/provider/service/windows.rb:167

    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: { logon_password: value })
  end

  private

  def normalize_logonaccount
    logon_account = @resource[:logonaccount].sub(/^\.\\/, "#{Puppet::Util::Windows::ADSI.computer_name}\\")
    return 'LocalSystem' if Puppet::Util::Windows::User.localsystem?(logon_account)

    @logonaccount_information ||= Puppet::Util::Windows::SID.name_to_principal(logon_account)
    return logon_account unless @logonaccount_information
    return ".\\#{@logonaccount_information.account}" if @logonaccount_information.domain == Puppet::Util::Windows::ADSI.computer_name

    @logonaccount_information.domain_account
  end

  def validate_logon_credentials
    unless Puppet::Util::Windows::User.localsystem?(@normalized_logon_account)
      raise Puppet::Error, "\"#{@normalized_logon_account}\" is not a valid account" unless @logonaccount_information && [:SidTypeUser, :SidTypeWellKnownGroup].include?(@logonaccount_information.account_type)

      user_rights = Puppet::Util::Windows::User.get_rights(@logonaccount_information.domain_account) unless Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account)
      raise Puppet::Error, "\"#{@normalized_logon_account}\" has the 'Log On As A Service' right set to denied." if user_rights =~ /SeDenyServiceLogonRight/
      raise Puppet::Error, "\"#{@normalized_logon_account}\" is missing the 'Log On As A Service' right." unless user_rights.nil? || user_rights =~ /SeServiceLogonRight/
    end

    is_a_predefined_local_account = Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account) || @normalized_logon_account == 'LocalSystem'
    account_info = @normalized_logon_account.split("\\")
    able_to_logon = Puppet::Util::Windows::User.password_is?(account_info[1], @resource[:logonpassword], account_info[0]) unless is_a_predefined_local_account
    raise Puppet::Error, "The given password is invalid for user '#{@normalized_logon_account}'." unless is_a_predefined_local_account || able_to_logon
  end
end

View on GitHub (pinned to e227c27540)

Solutions

1. Verify the account exists: `net user <name> /domain` or PowerShell `Get-ADUser <name>`; fix the string in the manifest.
2. Use the fully qualified form 'DOMAIN\user' or '.\localuser' (the provider expands the leading '.\' to the computer name).
3. If a built-in account is intended, use 'LocalSystem' or a well-known account, which take a separate path in validation.
4. Ensure the node can reach a domain controller and that name resolution (SID translation) succeeds before the Puppet run.

Example fix

# before
service { 'myapp':
  ensure       => running,
  logonaccount => 'DOMAIN\\svc_mapp',   # account does not exist
}
# after
service { 'myapp':
  ensure       => running,
  logonaccount => 'DOMAIN\\svc_myapp',
}

account = 'DOMAIN\\svc_myapp'
principal = Puppet::Util::Windows::SID.name_to_principal(account)
raise ArgumentError, "unresolvable account #{account}" unless principal
raise ArgumentError, "wrong principal type #{principal.account_type}" unless %i[SidTypeUser SidTypeWellKnownGroup].include?(principal.account_type)

def valid_logon_account?(account)
  return true if Puppet::Util::Windows::User.localsystem?(account)
  p = Puppet::Util::Windows::SID.name_to_principal(account)
  !p.nil? && %i[SidTypeUser SidTypeWellKnownGroup].include?(p.account_type)
end

When it happens

Trigger: Declaring a Windows service with `logonaccount => 'DOMAIN\missing_user'` (account does not exist), a malformed account string that cannot be resolved, or an account that resolves to a group (SidTypeGroup) or alias that is not permitted to log on as a service principal.

Common situations: Service account not yet created or renamed in AD; typo in domain or username; using a domain security group as logon account; running disconnected from the domain controller so name_to_principal fails.

Related errors

• "#{@normalized_logon_account}" has the 'Log On As A Service'
• "#{@normalized_logon_account}" is missing the 'Log On As A S
• The given password is invalid for user '#{@normalized_logon_
• RegisterEventSourceW failed to open Windows eventlog
• ReportEventW failed to report event to Windows eventlog

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/3d7c304093ed1eff. Report an issue: GitHub.