puppetlabs/puppet · error · ArgumentError

Unrecognized ADS UserFlags: %{unrecognized_flags}

Error message

Unrecognized ADS UserFlags: %{unrecognized_flags}

What it means

ArgumentError raised by User#op_userflags (shared by set_userflags / unset_userflags) when a flag argument is not a key of the ADS_USERFLAGS table that maps names like UF_SCRIPT or UF_DONT_EXPIRE_PASSWD to ADSI bit values. Unknown names cannot be translated, and the whole set operation is rejected before touching UserFlags.

Source

Thrown at lib/puppet/util/windows/adsi.rb:468

      ADS_UF_PASSWORD_EXPIRED: 0x800000,
      ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: 0x1000000
    }

    def userflag_set?(flag)
      flag_value = ADS_USERFLAGS[flag] || 0
      !(self['UserFlags'] & flag_value).zero?
    end

    # Common helper for set_userflags and unset_userflags.
    #
    # @api private
    def op_userflags(*flags, &block)
      # Avoid an unnecessary set + commit operation.
      return if flags.empty?

      unrecognized_flags = flags.reject { |flag| ADS_USERFLAGS.keys.include?(flag) }
      unless unrecognized_flags.empty?
        raise ArgumentError, _("Unrecognized ADS UserFlags: %{unrecognized_flags}") % { unrecognized_flags: unrecognized_flags.join(', ') }
      end

      self['UserFlags'] = flags.inject(self['UserFlags'], &block)
    end

    def set_userflags(*flags)
      op_userflags(*flags) { |userflags, flag| userflags | ADS_USERFLAGS[flag] }
    end

    def unset_userflags(*flags)
      op_userflags(*flags) { |userflags, flag| userflags & ~ADS_USERFLAGS[flag] }
    end

    def disabled?
      userflag_set?(:ADS_UF_ACCOUNTDISABLE)
    end

    def locked_out?

View on GitHub (pinned to e227c27540)

Solutions

1. List the supported names with Puppet::Util::Windows::ADSI::User::ADS_USERFLAGS.keys and correct the spelling.
2. Drop the unsupported flag, or upgrade Puppet if the flag is a legitimate ADSI constant missing from the table.

Example fix

# before
user.set_userflags('UF_DONT_EXPIRE_PASSWRD') # raises Unrecognized ADS UserFlags

# after
user.set_userflags('UF_DONT_EXPIRE_PASSWD')

KNOWN_FLAGS = Puppet::Util::Windows::ADSI::User::ADS_USERFLAGS.keys
def valid_userflags?(flags)
  flags.all? { |f| KNOWN_FLAGS.include?(f) }
end
valid_userflags?(['UF_SCRIPT', 'UF_DONT_EXPIRE_PASSWD']) # => true

begin
  user.set_userflags(*flags)
rescue ArgumentError => e
  raise "rejected userflags #{flags.inspect}: supported names are #{KNOWN_FLAGS.inspect}"
end

When it happens

Trigger: user.set_userflags('UF_SCRIPT', 'UF_MY_FLAG'), or a manifest feeding the user resource's flag handling with a misspelled name like 'UF_DONT_EXPIRE_PASSWRD' that is absent from ADS_USERFLAGS.

Common situations: Typos in flag names copied from MSDN; flags valid for a different ADSI schema version than the one Puppet's constant table covers.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Value must be in DOMAIN\\%{object_class} style syntax
• ads_object must be an IAdsUser or IAdsGroup instance
• Invalid value %{value}.
• Passwords cannot include ':'
• Failed to get computer name

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/012728b8009179e7. Report an issue: GitHub.