hashicorp/nomad · error

failed to create user token: %w

Error message

failed to create user token: %w

What it means

On Windows, setCmdUser impersonates the task user by calling createUserToken(domain, username), which performs a LogonUser call to obtain a security token. If token creation fails (bad credentials, logon-type denial, missing 'domain\user' format handled upstream), the underlying Windows error is wrapped here and the command is not launched.

Source

Thrown at drivers/shared/executor/executor_windows.go:56

func (e *UniversalExecutor) start(command *ExecCommand) error {
	return e.childCmd.Start()
}

func withNetworkIsolation(f func() error, _ *drivers.NetworkIsolationSpec) error {
	return f()
}

func setCmdUser(cmd *exec.Cmd, user string) error {
	if user == "" {
		return nil
	}
	nameParts := strings.Split(user, "\\")
	if len(nameParts) != 2 {
		return errors.New("user name must contain domain")
	}
	token, err := createUserToken(nameParts[0], nameParts[1])
	if err != nil {
		return fmt.Errorf("failed to create user token: %w", err)
	}

	if cmd.SysProcAttr == nil {
		cmd.SysProcAttr = &syscall.SysProcAttr{}
	}
	cmd.SysProcAttr.Token = *token

	runtime.AddCleanup(cmd, func(attr *syscall.SysProcAttr) {
		_ = attr.Token.Close()
	}, cmd.SysProcAttr)

	return nil
}

var (
	advapiDll      = windows.NewLazySystemDLL("advapi32.dll")
	procLogonUserW = advapiDll.NewProc("LogonUserW")
)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify the account exists and is enabled: run 'net user <name> /domain' and confirm 'DOMAIN\\user' format is correct.
2. Grant the Nomad client service account the local security rights 'Replace a process level token' and 'Adjust memory quotas for a process' (secpol.msc / gpedit).
3. Confirm the Nomad client runs with sufficient privilege (LocalSystem or an account with SeAssignPrimaryTokenPrivilege).
4. Test the logon manually, e.g. with 'runas /user:DOMAIN\\user cmd' to surface the Windows logon error code.
5. Check the wrapped error text for the Windows error code (e.g. ERROR_LOGON_FAILURE 1326 = bad credentials).

Example fix

// before
user = "appuser"  // missing domain
// after
user = "CORP\\appuser"

// Pre-flight (PowerShell, before scheduling Windows tasks)
try {
    $id = New-Object System.Security.Principal.NTAccount('CORP','appuser')
    $id.Translate([System.Security.Principal.SecurityIdentifier]) | Out-Null
    Write-Host 'user resolves'
} catch { Write-Error 'task user does not resolve on this host' }

if err := exec.SetUser(cmd, `CORP\appuser`); err != nil {
    if strings.Contains(err.Error(), "failed to create user token") {
        // inspect wrapped Windows code: 1326 bad creds, 1317 no such user,
        // 1385 logon right not granted
    }
    return fmt.Errorf("cannot launch task: %w", err)
}

When it happens

Trigger: createUserToken returns an error because procLogonUserW.Call fails: unknown user, wrong password (if a password path is used), account disabled, or the caller lacks SeAssignPrimaryTokenPrivilege when running as a service.

Common situations: Nomad client service account lacking 'Replace/Assign a process level token' rights; task user account locked or disabled; wrong domain in 'DOMAIN\\user'; running client in an environment where the user cannot log on interactively.

Related errors

• failed to convert username to UTF-16: %w
• failed to convert user domain to UTF-16: %w
• eventlog.level must be one of INFO, WARN, or ERROR
• running container as ContainerAdmin is unsafe; change the co
• QEMU graceful shutdown is unsupported on the Windows platfor

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/a9fe8b3ac851752c. Report an issue: GitHub.