puppetlabs/puppet · error · ArgumentError

Passwords cannot include ':'

Error message

Passwords cannot include ':'

What it means

On Windows services whose provider supports `manages_logon_credentials`, the `logonpassword` parameter validates that the password string contains no ':' (lib/puppet/type/service.rb:153), raising ArgumentError. The colon is a reserved separator in Puppet's logon-credential plumbing (account/password are round-tripped through colon-delimited handling), so such passwords are rejected up front. The value is marked sensitive so it is redacted in reports.

Source

Thrown at lib/puppet/type/service.rb:153

        event
      end
    end

    newproperty(:logonaccount, :required_features => :manages_logon_credentials) do
      desc "Specify an account for service logon"

      def insync?(current)
        return provider.logonaccount_insync?(current) if provider.respond_to?(:logonaccount_insync?)

        super(current)
      end
    end

    newparam(:logonpassword, :required_features => :manages_logon_credentials) do
      desc "Specify a password for service logon. Default value is an empty string (when logonaccount is specified)."

      validate do |value|
        raise ArgumentError, _("Passwords cannot include ':'") if value.is_a?(String) && value.include?(":")
      end

      sensitive true
      defaultto { @resource[:logonaccount] ? "" : nil }
    end

    newproperty(:flags, :required_features => :flaggable) do
      desc "Specify a string of flags to pass to the startup script."
    end

    newparam(:binary) do
      desc "The path to the daemon.  This is only used for
        systems that do not support init scripts.  This binary will be
        used to start the service if no `start` parameter is
        provided."
    end

    newparam(:hasstatus) do

View on GitHub (pinned to e227c27540)

Solutions

1. Change the service account password to one without ':' (regenerate from your secret store with a ':'-free alphabet)
2. Restrict the generator's character set for service logon passwords
3. If the password cannot change, use a gMSA / managed account and drop logonpassword

Example fix

# before
service { 'mysvc':
  ensure        => running,
  logonaccount  => '.\\svc_user',
  logonpassword => 'p@ss:w0rd',
}

# after
service { 'mysvc':
  ensure        => running,
  logonaccount  => '.\\svc_user',
  logonpassword => 'p@ssw0rd',
}

# profile guard
if $logonpassword =~ /:/ {
  fail('service logon passwords must not contain a colon')
}

def valid_logonpassword?(pw)
  pw.is_a?(String) && !pw.include?(':')
end

begin
  Puppet::Type.type(:service).new(
    name: 'mysvc', logonaccount: '.\\svc_user', logonpassword: 'p@ss:w0rd'
  )
rescue ArgumentError => e
  raise unless e.message.include?("Passwords cannot include ':'")
  # regenerate the secret without ':' — do not log the value
end

When it happens

Trigger: `service { 'svc': logonaccount => 'DOMAIN\\user', logonpassword => 'pa:ssword' }` on Windows; any programmatically generated password whose alphabet includes ':'.

Common situations: Random-password generators that include full punctuation; secrets pulled from Vault/Hiera that happen to contain colons; machines migrated from other CM tools that allowed ':' in service passwords.

Related errors

• The 'logonaccount' parameter is mandatory when setting 'logo
• Passwords cannot include ':'
• Value must be in DOMAIN\\%{object_class} style syntax
• Unrecognized ADS UserFlags: %{unrecognized_flags}
• Byte array for lookup_account_sid must not be nil and must b

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/6cec7d930861b4c4. Report an issue: GitHub.