{"record":{"id":"390dfa61b9ec8b65","repo":"hashicorp/nomad","slug":"user-name-must-contain-domain","errorCode":null,"errorMessage":"user name must contain domain","messagePattern":"user name must contain domain","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/executor/executor_windows.go","lineNumber":52,"sourceCode":"\trunning := func() error { return nil }\n\treturn running, cleanup, nil\n}\n\nfunc (e *UniversalExecutor) start(command *ExecCommand) error {\n\treturn e.childCmd.Start()\n}\n\nfunc withNetworkIsolation(f func() error, _ *drivers.NetworkIsolationSpec) error {\n\treturn f()\n}\n\nfunc setCmdUser(cmd *exec.Cmd, user string) error {\n\tif user == \"\" {\n\t\treturn nil\n\t}\n\tnameParts := strings.Split(user, \"\\\\\")\n\tif len(nameParts) != 2 {\n\t\treturn errors.New(\"user name must contain domain\")\n\t}\n\ttoken, err := createUserToken(nameParts[0], nameParts[1])\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create user token: %w\", err)\n\t}\n\n\tif cmd.SysProcAttr == nil {\n\t\tcmd.SysProcAttr = &syscall.SysProcAttr{}\n\t}\n\tcmd.SysProcAttr.Token = *token\n\n\truntime.AddCleanup(cmd, func(attr *syscall.SysProcAttr) {\n\t\t_ = attr.Token.Close()\n\t}, cmd.SysProcAttr)\n\n\treturn nil\n}\n","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/executor/executor_windows.go#L34-L70","documentation":"On Windows, the executor's setCmdUser requires the user to be given in DOMAIN\\username form because it builds a Windows access token via createUserToken(domain, name). A bare username without a backslash cannot be split into domain and name parts, so it errors before launching the process.","triggerScenarios":"Starting a rawexec/java task on a Windows Nomad client with user = \"svcaccount\" (no domain prefix); the executor calls setCmdUser whenever the task specifies a user, and the strings.Split on \"\\\\\" yields exactly one part.","commonSituations":"Job specs ported from Linux where \"appuser\" is valid; operators forgetting the machine-name prefix for local accounts (should be MACHINENAME\\user); service accounts from AD used without the NETBIOS domain; typo using \"/\" instead of \"\\\\\".","solutions":["Change user to include the domain, e.g. user = \"MYDOMAIN\\\\svcaccount\"","For local accounts use the computer name as the domain: user = \"HOSTNAME\\\\localuser\"","Remove the user field to run as the Nomad client's default account if impersonation is not needed","Verify the domain NETBIOS name (not FQDN) with whoami on the target host"],"exampleFix":"// before\nuser = \"svcaccount\"\n// after\nuser = \"CORP\\\\svcaccount\"","handlingStrategy":"validation","validationCode":"func checkWindowsUser(u string) error {\n    if u == \"\" { return nil }\n    if runtime.GOOS == \"windows\" && len(strings.Split(u, \"\\\\\")) != 2 {\n        return errors.New(\"user must be DOMAIN\\\\username on windows\")\n    }\n    return nil\n}","typeGuard":"func isDomainQualifiedUser(u string) bool { return len(strings.Split(u, \"\\\\\")) == 2 }","tryCatchPattern":null,"preventionTips":["Always specify users as DOMAIN\\\\username on Windows tasks","Use the machine's NETBIOS name for local accounts","Lint job specs: bare usernames are only valid on non-Windows clients"],"tags":["windows","user-impersonation","executor","nomad"],"backgroundTag":"invalid-user-format","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}