{"record":{"id":"c74698ad3df28ac0","repo":"hashicorp/nomad","slug":"could-not-create-windows-job-object-for-executor","errorCode":null,"errorMessage":"could not create Windows job object for executor: %w","messagePattern":"could not create Windows job object for executor: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/executor/executor_windows.go","lineNumber":128,"sourceCode":"func (e *UniversalExecutor) setSubCmdCgroup(*exec.Cmd, string) (func(), error) {\n\treturn func() {}, nil\n}\n\n// configure new process group for child process and creates a JobObject for the\n// executor. Children of the executor will be created in the same JobObject\n// Ref: https://learn.microsoft.com/en-us/windows/win32/procthread/job-objects\nfunc (e *UniversalExecutor) setNewProcessGroup() error {\n\t// We need to check that as build flags includes windows for this file\n\tif e.childCmd.SysProcAttr == nil {\n\t\te.childCmd.SysProcAttr = &syscall.SysProcAttr{}\n\t}\n\te.childCmd.SysProcAttr.CreationFlags = syscall.CREATE_NEW_PROCESS_GROUP\n\n\t// note: we don't call CloseHandle on this job handle because we need to\n\t// hold onto it until the executor exits\n\tjob, err := windows.CreateJobObject(nil, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not create Windows job object for executor: %w\", err)\n\t}\n\n\tinfo := windows.JOBOBJECT_EXTENDED_LIMIT_INFORMATION{\n\t\tBasicLimitInformation: windows.JOBOBJECT_BASIC_LIMIT_INFORMATION{\n\t\t\tLimitFlags: windows.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,\n\t\t},\n\t}\n\t_, err = windows.SetInformationJobObject(\n\t\tjob,\n\t\twindows.JobObjectExtendedLimitInformation,\n\t\tuintptr(unsafe.Pointer(&info)),\n\t\tuint32(unsafe.Sizeof(info)))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not configure Windows job object for executor: %w\", err)\n\t}\n\n\thandle := windows.CurrentProcess()\n\terr = windows.AssignProcessToJobObject(job, handle)","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/executor/executor_windows.go#L110-L146","documentation":"Nomad's Windows executor creates a Job Object (with JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE) so all child processes die when the executor exits. If windows.CreateJobObject fails (kernel call error, out of handles, security policy), the executor wraps and returns the error instead of running the task without cleanup guarantees.","triggerScenarios":"windows.CreateJobObject(nil, nil) returns a non-nil error — kernel object creation failure, exhausted handles, or restrictive security software blocking job object creation.","commonSituations":"Hosts with endpoint/AV software hooking kernel object creation; severe handle/memory exhaustion; hardened Windows images with restricted object creation for the service account.","solutions":["Re-run as a privileged/service account and retry; inspect the wrapped Windows error code via '%v'.","Check antivirus/EDR software for job-object creation hooks and add exclusions for the Nomad/executor binaries.","Free system resources (handles, commit memory) on the host and restart the Nomad client.","Reboot the host if kernel object tables are exhausted (event log will show resource errors)."],"exampleFix":"// before\nC:\\> nomad.exe agent -dev  # under restrictive AV, job object creation fails\n// after: add exclusion\nSet-MpPreference -ExclusionProcess \"nomad.exe\",\"nomad_executor.exe\"  # or adjust EDR policy, then restart the client","handlingStrategy":"fallback","validationCode":"// Go: probe job-object creation capability before scheduling tasks\nif _, err := windows.CreateJobObject(nil, nil); err != nil {\n    return fmt.Errorf(\"host cannot create job objects: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := e.setNewProcessGroup(); err != nil {\n    if strings.Contains(err.Error(), \"create Windows job object\") {\n        // degraded mode: still launch but child procs may outlive executor;\n        // alert and mark client unhealthy instead\n    }\n    return err\n}","preventionTips":["Verify AV/EDR policy permits Job Object creation on client hosts.","Keep handle/memory pressure monitored on Windows clients.","Prefer running the Nomad client as LocalSystem.","Test on hardened/golden images before fleet rollout."],"tags":["windows","job-object","process-management","kernel"],"backgroundTag":"job-object-creation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}