puppetlabs/puppet · error · Puppet::Error

The given password is invalid for user '#{@normalized_logon_

Error message

The given password is invalid for user '#{@normalized_logon_account}'.

What it means

Raised by Puppet's Windows service provider when the supplied `logonpassword` fails validation for the given `logonaccount`. validate_logon_credentials splits the normalized account into domain and user and calls Puppet::Util::Windows::User.password_is?, which attempts an actual logon; returning false (wrong password) produces this error. Predefined local accounts (LocalSystem etc.) skip the check.

Source

Thrown at lib/puppet/provider/service/windows.rb:177

    return logon_account unless @logonaccount_information
    return ".\\#{@logonaccount_information.account}" if @logonaccount_information.domain == Puppet::Util::Windows::ADSI.computer_name

    @logonaccount_information.domain_account
  end

  def validate_logon_credentials
    unless Puppet::Util::Windows::User.localsystem?(@normalized_logon_account)
      raise Puppet::Error, "\"#{@normalized_logon_account}\" is not a valid account" unless @logonaccount_information && [:SidTypeUser, :SidTypeWellKnownGroup].include?(@logonaccount_information.account_type)

      user_rights = Puppet::Util::Windows::User.get_rights(@logonaccount_information.domain_account) unless Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account)
      raise Puppet::Error, "\"#{@normalized_logon_account}\" has the 'Log On As A Service' right set to denied." if user_rights =~ /SeDenyServiceLogonRight/
      raise Puppet::Error, "\"#{@normalized_logon_account}\" is missing the 'Log On As A Service' right." unless user_rights.nil? || user_rights =~ /SeServiceLogonRight/
    end

    is_a_predefined_local_account = Puppet::Util::Windows::User.default_system_account?(@normalized_logon_account) || @normalized_logon_account == 'LocalSystem'
    account_info = @normalized_logon_account.split("\\")
    able_to_logon = Puppet::Util::Windows::User.password_is?(account_info[1], @resource[:logonpassword], account_info[0]) unless is_a_predefined_local_account
    raise Puppet::Error, "The given password is invalid for user '#{@normalized_logon_account}'." unless is_a_predefined_local_account || able_to_logon
  end
end

View on GitHub (pinned to e227c27540)

Solutions

1. Verify the credential interactively: `runas /user:DOMAIN\svc_x cmd` or a PowerShell LogonUser test to confirm the password itself.
2. Update the password in Hiera/vault and re-run; prefer auto-retrieved secrets over inline literals.
3. Check account state for lockout/expiry (`Get-ADUser -Properties LockedOut,PasswordExpired`) and unlock/reset if needed.
4. Audit manifest quoting: in single-quoted Puppet strings, backslashes and `$` behave differently — ensure 'DOMAIN\\svc' and special characters are escaped correctly.
5. If the account's password policy forces periodic change, consider a gMSA so no password is managed at all.

Example fix

# before - literal goes stale after rotation
service { 'myapp':
  ensure        => running,
  logonaccount  => 'DOMAIN\\svc_myapp',
  logonpassword => 'Summer2024!',
}
# after - retrieve from secret store
service { 'myapp':
  ensure        => running,
  logonaccount  => 'DOMAIN\\svc_myapp',
  logonpassword => lookup('profiles::myapp::svc_password', Sensitive),
}

domain, user = 'DOMAIN\\svc_myapp'.split('\\')
ok = Puppet::Util::Windows::User.password_is?(user, candidate_password, domain)
raise ArgumentError, 'credential check failed' unless ok

def credential_valid?(account, password)
  domain, user = account.split('\\')
  Puppet::Util::Windows::User.password_is?(user, password, domain)
end

When it happens

Trigger: Declaring a service with `logonaccount => 'DOMAIN\\svc_x', logonpassword => '...'` where the password is wrong, expired/locked out, the account must change password at next logon, or the manifest stored the password with mangled quoting/escaping so the string does not match.

Common situations: Password rotated in AD but not in Puppet (vault/Hiera); expired service-account password; single quotes vs escaping of special characters like `$` in manifests; copy-paste truncation of long passwords.

Related errors

• "#{@normalized_logon_account}" is not a valid account
• "#{@normalized_logon_account}" has the 'Log On As A Service'
• "#{@normalized_logon_account}" is missing the 'Log On As A S
• The 'logonaccount' parameter is mandatory when setting 'logo
• password must be specified if with_logon is used

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/41e15c1edadf96d0. Report an issue: GitHub.