puppetlabs/puppet · error · Puppet::Error

The 'logonaccount' parameter is mandatory when setting 'logo

Error message

The 'logonaccount' parameter is mandatory when setting 'logonpassword'.

What it means

The service type's resource-level validate raises Puppet::Error when `logonpassword` is set without `logonaccount` (lib/puppet/type/service.rb:306): a logon password is meaningless without the account it authenticates. logonpassword defaults to '' only when logonaccount is present.

Source

Thrown at lib/puppet/type/service.rb:306

    # Basically just a synonym for restarting.  Used to respond
    # to events.
    def refresh
      # Only restart if we're actually running
      if (@parameters[:ensure] || newattr(:ensure)).retrieve == :running
        provider.restart
      else
        debug "Skipping restart; service is not running"
      end
    end

    def self.needs_ensure_retrieved
      false
    end

    validate do
      if @parameters[:logonpassword] && @parameters[:logonaccount].nil?
        raise Puppet::Error, _("The 'logonaccount' parameter is mandatory when setting 'logonpassword'.")
      end
    end
  end
end

View on GitHub (pinned to e227c27540)

Solutions

1. Add `logonaccount` (e.g. '.\\svc_user' or 'DOMAIN\\user') alongside logonpassword
2. Or remove logonpassword if you do not manage Windows logon credentials
3. In wrappers, set both from the same Hiera namespace and fail together if incomplete

Example fix

# before
service { 'mysvc':
  ensure        => running,
  logonpassword => 'P@ssw0rd',
}

# after
service { 'mysvc':
  ensure        => running,
  logonaccount  => '.\\svc_user',
  logonpassword => 'P@ssw0rd',
}

if $logonpassword != undef and $logonaccount == undef {
  fail('logonaccount is required when logonpassword is set')
}

def credentials_complete?(params)
  params[:logonpassword].nil? || !params[:logonaccount].nil?
end

begin
  Puppet::Type.type(:service).new(name: 'svc', logonpassword: 'secret')
rescue Puppet::Error => e
  raise unless e.message.include?('logonaccount')
  # supply logonaccount or drop the password
end

When it happens

Trigger: `service { 'svc': logonpassword => 'secret' }` with no logonaccount; profiles that set the password from Hiera while the account is optional/undef for some nodes.

Common situations: Wrapper classes with optional credentials where only the password key exists in Hiera; refactors splitting credential parameters; typos in the logonaccount key name.

Understand the failure class

Background: Missing required parameter errors: what 'X is required' and 'the required X param is missing' mean, and how to fix them — this error's family across 27 libraries.

Related errors

• The given password is invalid for user '#{@normalized_logon_
• Passwords cannot include ':'
• password must be specified if with_logon is used
• Service query for %{parameter_name} failed
• Failed to send the %{control_signal} signal to the service.

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/aad0e659949a169b. Report an issue: GitHub.