{"record":{"id":"a9fe8b3ac851752c","repo":"hashicorp/nomad","slug":"failed-to-create-user-token-w","errorCode":null,"errorMessage":"failed to create user token: %w","messagePattern":"failed to create user token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/executor/executor_windows.go","lineNumber":56,"sourceCode":"func (e *UniversalExecutor) start(command *ExecCommand) error {\n\treturn e.childCmd.Start()\n}\n\nfunc withNetworkIsolation(f func() error, _ *drivers.NetworkIsolationSpec) error {\n\treturn f()\n}\n\nfunc setCmdUser(cmd *exec.Cmd, user string) error {\n\tif user == \"\" {\n\t\treturn nil\n\t}\n\tnameParts := strings.Split(user, \"\\\\\")\n\tif len(nameParts) != 2 {\n\t\treturn errors.New(\"user name must contain domain\")\n\t}\n\ttoken, err := createUserToken(nameParts[0], nameParts[1])\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create user token: %w\", err)\n\t}\n\n\tif cmd.SysProcAttr == nil {\n\t\tcmd.SysProcAttr = &syscall.SysProcAttr{}\n\t}\n\tcmd.SysProcAttr.Token = *token\n\n\truntime.AddCleanup(cmd, func(attr *syscall.SysProcAttr) {\n\t\t_ = attr.Token.Close()\n\t}, cmd.SysProcAttr)\n\n\treturn nil\n}\n\nvar (\n\tadvapiDll      = windows.NewLazySystemDLL(\"advapi32.dll\")\n\tprocLogonUserW = advapiDll.NewProc(\"LogonUserW\")\n)","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/executor/executor_windows.go#L38-L74","documentation":"On Windows, setCmdUser impersonates the task user by calling createUserToken(domain, username), which performs a LogonUser call to obtain a security token. If token creation fails (bad credentials, logon-type denial, missing 'domain\\user' format handled upstream), the underlying Windows error is wrapped here and the command is not launched.","triggerScenarios":"createUserToken returns an error because procLogonUserW.Call fails: unknown user, wrong password (if a password path is used), account disabled, or the caller lacks SeAssignPrimaryTokenPrivilege when running as a service.","commonSituations":"Nomad client service account lacking 'Replace/Assign a process level token' rights; task user account locked or disabled; wrong domain in 'DOMAIN\\\\user'; running client in an environment where the user cannot log on interactively.","solutions":["Verify the account exists and is enabled: run 'net user <name> /domain' and confirm 'DOMAIN\\\\user' format is correct.","Grant the Nomad client service account the local security rights 'Replace a process level token' and 'Adjust memory quotas for a process' (secpol.msc / gpedit).","Confirm the Nomad client runs with sufficient privilege (LocalSystem or an account with SeAssignPrimaryTokenPrivilege).","Test the logon manually, e.g. with 'runas /user:DOMAIN\\\\user cmd' to surface the Windows logon error code.","Check the wrapped error text for the Windows error code (e.g. ERROR_LOGON_FAILURE 1326 = bad credentials)."],"exampleFix":"// before\nuser = \"appuser\"  // missing domain\n// after\nuser = \"CORP\\\\appuser\"","handlingStrategy":"try-catch","validationCode":"// Pre-flight (PowerShell, before scheduling Windows tasks)\ntry {\n    $id = New-Object System.Security.Principal.NTAccount('CORP','appuser')\n    $id.Translate([System.Security.Principal.SecurityIdentifier]) | Out-Null\n    Write-Host 'user resolves'\n} catch { Write-Error 'task user does not resolve on this host' }","typeGuard":null,"tryCatchPattern":"if err := exec.SetUser(cmd, `CORP\\appuser`); err != nil {\n    if strings.Contains(err.Error(), \"failed to create user token\") {\n        // inspect wrapped Windows code: 1326 bad creds, 1317 no such user,\n        // 1385 logon right not granted\n    }\n    return fmt.Errorf(\"cannot launch task: %w\", err)\n}","preventionTips":["Always specify user as 'DOMAIN\\\\user' on Windows clients.","Grant the Nomad service account 'Replace a process level token' and 'Adjust memory quotas' rights.","Keep task accounts enabled and unlocked; check with 'net user <name> /domain'.","Test with 'runas /user:DOMAIN\\\\user cmd' before production rollout."],"tags":["windows","logonuser","token","impersonation"],"backgroundTag":"logon-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}