{"record":{"id":"c7113c1889b05029","repo":"puppetlabs/puppet","slug":"cannot-create-user-if-group-name-exists","errorCode":null,"errorMessage":"Cannot create user if group '%{name}' exists.","messagePattern":"Cannot create user if group '%(.+?)' exists\\.","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/adsi.rb","lineNumber":320,"sourceCode":"\n    require_relative '../../../puppet/util/windows/sid'\n\n    # https://msdn.microsoft.com/en-us/library/aa746340.aspx\n    # IADsUser interface\n    @object_class = 'user'\n\n    class << self\n      def list_all\n        Puppet::Util::Windows::ADSI.execquery('select name from win32_useraccount where localaccount = \"TRUE\"')\n      end\n\n      def logon(name, password)\n        Puppet::Util::Windows::User.password_is?(name, password)\n      end\n\n      def create(name)\n        # Windows error 1379: The specified local group already exists.\n        raise Puppet::Error, _(\"Cannot create user if group '%{name}' exists.\") % { name: name } if Puppet::Util::Windows::ADSI::Group.exists? name\n\n        new(name, Puppet::Util::Windows::ADSI.create(name, @object_class))\n      end\n    end\n\n    def password_is?(password)\n      self.class.logon(name, password)\n    end\n\n    def add_flag(flag_name, value)\n      flag = begin\n        native_object.Get(flag_name)\n      rescue\n        0\n      end\n\n      native_object.Put(flag_name, flag | value)\n","sourceCodeStart":302,"sourceCodeEnd":338,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/adsi.rb#L302-L338","documentation":"Raised by Puppet::Util::Windows::ADSI::User.create before any directory write: Windows SAM keeps users and groups in a single namespace per machine, so a user and a group cannot share a name. The pre-check Group.exists?(name) blocks creation when a local group with that name already exists.","triggerScenarios":"A user resource whose title equals an existing local group name (user 'app' while group 'app' exists), including when a group resource earlier in the same catalog run created the colliding group.","commonSituations":"Porting Unix conventions where a user and its group share a name to Windows; refactoring a resource from group to user without removing or renaming the old group.","solutions":["Choose a different name for the user, or remove/rename the conflicting group first.","If Puppet manages both, decide which resource keeps the name and update all references."],"exampleFix":"# before\ngroup { 'app': ensure => present }\nuser  { 'app': ensure => present } # raises on Windows\n\n# after\ngroup { 'app': ensure => present }\nuser  { 'svc_app': ensure => present }","handlingStrategy":"validation","validationCode":"if Puppet::Util::Windows::ADSI::Group.exists?(name)\n  raise ArgumentError, \"name #{name.inspect} is taken by a local group\"\nend\nPuppet::Util::Windows::ADSI::User.create(name)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check `net localgroup` output when planning account names.","Avoid identical user/group names in cross-platform modules.","Record the SAM namespace constraint in design notes."],"tags":["puppet","windows","adsi","sam","name-collision","users"],"backgroundTag":"account-name-collision","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}