hashicorp/nomad · error

user name must contain domain

Error message

user name must contain domain

What it means

On Windows, the executor's setCmdUser requires the user to be given in DOMAIN\username form because it builds a Windows access token via createUserToken(domain, name). A bare username without a backslash cannot be split into domain and name parts, so it errors before launching the process.

Source

Thrown at drivers/shared/executor/executor_windows.go:52

	running := func() error { return nil }
	return running, cleanup, nil
}

func (e *UniversalExecutor) start(command *ExecCommand) error {
	return e.childCmd.Start()
}

func withNetworkIsolation(f func() error, _ *drivers.NetworkIsolationSpec) error {
	return f()
}

func setCmdUser(cmd *exec.Cmd, user string) error {
	if user == "" {
		return nil
	}
	nameParts := strings.Split(user, "\\")
	if len(nameParts) != 2 {
		return errors.New("user name must contain domain")
	}
	token, err := createUserToken(nameParts[0], nameParts[1])
	if err != nil {
		return fmt.Errorf("failed to create user token: %w", err)
	}

	if cmd.SysProcAttr == nil {
		cmd.SysProcAttr = &syscall.SysProcAttr{}
	}
	cmd.SysProcAttr.Token = *token

	runtime.AddCleanup(cmd, func(attr *syscall.SysProcAttr) {
		_ = attr.Token.Close()
	}, cmd.SysProcAttr)

	return nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Change user to include the domain, e.g. user = "MYDOMAIN\\svcaccount"
2. For local accounts use the computer name as the domain: user = "HOSTNAME\\localuser"
3. Remove the user field to run as the Nomad client's default account if impersonation is not needed
4. Verify the domain NETBIOS name (not FQDN) with whoami on the target host

Example fix

// before
user = "svcaccount"
// after
user = "CORP\\svcaccount"

func checkWindowsUser(u string) error {
    if u == "" { return nil }
    if runtime.GOOS == "windows" && len(strings.Split(u, "\\")) != 2 {
        return errors.New("user must be DOMAIN\\username on windows")
    }
    return nil
}

func isDomainQualifiedUser(u string) bool { return len(strings.Split(u, "\\")) == 2 }

When it happens

Trigger: Starting a rawexec/java task on a Windows Nomad client with user = "svcaccount" (no domain prefix); the executor calls setCmdUser whenever the task specifies a user, and the strings.Split on "\\" yields exactly one part.

Common situations: Job specs ported from Linux where "appuser" is valid; operators forgetting the machine-name prefix for local accounts (should be MACHINENAME\user); service accounts from AD used without the NETBIOS domain; typo using "/" instead of "\\".

Related errors

• running container as ContainerAdmin is unsafe; change the co
• QEMU graceful shutdown is unsupported on the Windows platfor
• ErrCgroupMustBeSet
• failed to create executor: %v
• failed to reattach to executor: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/390dfa61b9ec8b65. Report an issue: GitHub.