{"record":{"id":"f8bcb1f69d305b82","repo":"puppetlabs/puppet","slug":"puppet-is-not-able-to-create-delete-domain-objec","errorCode":null,"errorMessage":"Puppet is not able to create/delete domain %{object_class} objects with the %{object_class} resource.","messagePattern":"Puppet is not able to create/delete domain %(.+?) objects with the %(.+?) resource\\.","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/adsi.rb","lineNumber":291,"sourceCode":"      @sid ||= Puppet::Util::Windows::SID.octet_string_to_principal(native_object.objectSID)\n    end\n\n    def [](attribute)\n      # Setting WIN32OLE.codepage ensures values are returned as UTF-8\n      native_object.Get(attribute)\n    end\n\n    def []=(attribute, value)\n      native_object.Put(attribute, value)\n    end\n\n    def commit\n      begin\n        native_object.SetInfo\n      rescue WIN32OLERuntimeError => e\n        # ERROR_BAD_USERNAME 2202L from winerror.h\n        if e.message =~ /8007089A/m\n          raise Puppet::Error, _(\"Puppet is not able to create/delete domain %{object_class} objects with the %{object_class} resource.\") % { object_class: object_class }\n        end\n\n        raise Puppet::Error.new(_(\"%{object_class} update failed: %{error}\") % { object_class: object_class.capitalize, error: e }, e)\n      end\n      self\n    end\n  end\n\n  class User < ADSIObject\n    extend FFI::Library\n\n    require_relative '../../../puppet/util/windows/sid'\n\n    # https://msdn.microsoft.com/en-us/library/aa746340.aspx\n    # IADsUser interface\n    @object_class = 'user'\n\n    class << self","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/adsi.rb#L273-L309","documentation":"Raised from ADSIObject#commit when the underlying OLE SetInfo call fails with ERROR_BAD_USERNAME (winerror 2202, HRESULT 0x8007089A). Puppet's user/group resources operate through the WinNT provider, which can enumerate but not create, modify, or delete domain objects — so when the target name resolves to a domain account, the write is rejected with this message.","triggerScenarios":"Declaring a puppet user or group resource whose name is a domain account ('DOMAIN\\\\app-admins', or a bare name that resolves against a trusted domain); any ensure/update/delete of such a name hits SetInfo and fails with 2202.","commonSituations":"Trying to manage AD users/groups with the built-in windows user/group types instead of AD tooling; machines where the local name slot is empty so lookup falls through to the domain.","solutions":["Use the built-in user/group resources only for local accounts: drop the DOMAIN\\\\ prefix or target a genuinely local name.","For AD objects, switch to AD-capable management (puppetlabs-dsc / PowerShell, or an AD-specific module).","If a local account of that name was intended, make sure the resource references the machine-local name explicitly."],"exampleFix":"# before: local group resource pointed at a domain group\ngroup { 'DOMAIN\\\\app-admins': ensure => present }\n\n# after: manage a local group, or use DSC/PowerShell for the AD object\ngroup { 'app-admins': ensure => present }","handlingStrategy":"validation","validationCode":"domain, _acct = name.split('\\\\')\nlocal = [ENV['COMPUTERNAME'], Socket.gethostname].map(&:downcase)\nif domain && !local.include?(domain.downcase)\n  raise ArgumentError, \"#{name.inspect} is a domain object; manage it with DSC/AD tooling, not the local user/group resource\"\nend","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use built-in user/group resources for local accounts only.","Manage AD objects via puppetlabs-dsc or PowerShell modules.","Document which names are machine-local in module READMEs."],"tags":["puppet","windows","adsi","domain","winnt-provider","access-denied"],"backgroundTag":"domain-account-modification-unsupported","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}