{"record":{"id":"696643c8f2857710","repo":"puppetlabs/puppet","slug":"cannot-create-group-if-user-name-exists","errorCode":null,"errorMessage":"Cannot create group if user '%{name}' exists.","messagePattern":"Cannot create group if user '%(.+?)' exists\\.","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/adsi.rb","lineNumber":612,"sourceCode":"      raise e unless e.message.include?('80041010')\n\n      Puppet.warning _(\"Cannot delete user profile for '%{sid}' prior to Vista SP1\") % { sid: sid }\n    end\n  end\n\n  class Group < ADSIObject\n    # https://msdn.microsoft.com/en-us/library/aa706021.aspx\n    # IADsGroup interface\n    @object_class = 'group'\n\n    class << self\n      def list_all\n        Puppet::Util::Windows::ADSI.execquery('select name from win32_group where localaccount = \"TRUE\"')\n      end\n\n      def create(name)\n        # Windows error 2224: The account already exists.\n        raise Puppet::Error, _(\"Cannot create group if user '%{name}' exists.\") % { name: name } if Puppet::Util::Windows::ADSI::User.exists?(name)\n\n        new(name, Puppet::Util::Windows::ADSI.create(name, @object_class))\n      end\n    end\n\n    def add_member_sids(*sids)\n      sids.each do |sid|\n        native_object.Add(Puppet::Util::Windows::ADSI.sid_uri(sid))\n      end\n    end\n\n    def remove_member_sids(*sids)\n      sids.each do |sid|\n        native_object.Remove(Puppet::Util::Windows::ADSI.sid_uri(sid))\n      end\n    end\n\n    # returns Puppet::Util::Windows::SID::Principal[]","sourceCodeStart":594,"sourceCodeEnd":630,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/adsi.rb#L594-L630","documentation":"Mirror of the user case: Puppet::Util::Windows::ADSI::Group.create raises when a local user with the requested group name already exists, because Windows SAM does not allow a user and a group to share one name on a machine.","triggerScenarios":"A group resource whose name equals an existing local user (group 'bob' while user 'bob' exists), including catalogs that manage the user resource earlier in the same run.","commonSituations":"Cross-platform modules reusing a Unix-style shared user/group name; generated account-name schemes that don't keep the two namespaces distinct on Windows.","solutions":["Rename the group, or remove/rename the conflicting user first.","Adjust naming policy so users and groups never collide on Windows nodes."],"exampleFix":"# before\nuser  { 'app': ensure => present }\ngroup { 'app': ensure => present } # raises on Windows\n\n# after\nuser  { 'app': ensure => present }\ngroup { 'app_grp': ensure => present }","handlingStrategy":"validation","validationCode":"if Puppet::Util::Windows::ADSI::User.exists?(name)\n  raise ArgumentError, \"name #{name.inspect} is taken by a local user\"\nend\nPuppet::Util::Windows::ADSI::Group.create(name)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep user and group names distinct in naming schemes for Windows nodes.","Check `net user` output before creating groups with shared names.","Add spec coverage for name-collision paths in Windows modules."],"tags":["puppet","windows","adsi","sam","name-collision","groups"],"backgroundTag":"account-name-collision","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}