puppetlabs/puppet · error · Puppet::Error

Cannot create group if user '%{name}' exists.

Error message

Cannot create group if user '%{name}' exists.

What it means

Mirror of the user case: Puppet::Util::Windows::ADSI::Group.create raises when a local user with the requested group name already exists, because Windows SAM does not allow a user and a group to share one name on a machine.

Source

Thrown at lib/puppet/util/windows/adsi.rb:612

      raise e unless e.message.include?('80041010')

      Puppet.warning _("Cannot delete user profile for '%{sid}' prior to Vista SP1") % { sid: sid }
    end
  end

  class Group < ADSIObject
    # https://msdn.microsoft.com/en-us/library/aa706021.aspx
    # IADsGroup interface
    @object_class = 'group'

    class << self
      def list_all
        Puppet::Util::Windows::ADSI.execquery('select name from win32_group where localaccount = "TRUE"')
      end

      def create(name)
        # Windows error 2224: The account already exists.
        raise Puppet::Error, _("Cannot create group if user '%{name}' exists.") % { name: name } if Puppet::Util::Windows::ADSI::User.exists?(name)

        new(name, Puppet::Util::Windows::ADSI.create(name, @object_class))
      end
    end

    def add_member_sids(*sids)
      sids.each do |sid|
        native_object.Add(Puppet::Util::Windows::ADSI.sid_uri(sid))
      end
    end

    def remove_member_sids(*sids)
      sids.each do |sid|
        native_object.Remove(Puppet::Util::Windows::ADSI.sid_uri(sid))
      end
    end

    # returns Puppet::Util::Windows::SID::Principal[]

View on GitHub (pinned to e227c27540)

Solutions

1. Rename the group, or remove/rename the conflicting user first.
2. Adjust naming policy so users and groups never collide on Windows nodes.

Example fix

# before
user  { 'app': ensure => present }
group { 'app': ensure => present } # raises on Windows

# after
user  { 'app': ensure => present }
group { 'app_grp': ensure => present }

if Puppet::Util::Windows::ADSI::User.exists?(name)
  raise ArgumentError, "name #{name.inspect} is taken by a local user"
end
Puppet::Util::Windows::ADSI::Group.create(name)

When it happens

Trigger: A group resource whose name equals an existing local user (group 'bob' while user 'bob' exists), including catalogs that manage the user resource earlier in the same run.

Common situations: Cross-platform modules reusing a Unix-style shared user/group name; generated account-name schemes that don't keep the two namespaces distinct on Windows.

Related errors

• Cannot create user if group '%{name}' exists.
• Could not resolve name: %{name}
• Failed to get computer name
• Value must be in DOMAIN\\%{object_class} style syntax
• Puppet is not able to create/delete domain %{object_class} o

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/696643c8f2857710. Report an issue: GitHub.