puppetlabs/puppet · error · Puppet::Error

Cannot create user if group '%{name}' exists.

Error message

Cannot create user if group '%{name}' exists.

What it means

Raised by Puppet::Util::Windows::ADSI::User.create before any directory write: Windows SAM keeps users and groups in a single namespace per machine, so a user and a group cannot share a name. The pre-check Group.exists?(name) blocks creation when a local group with that name already exists.

Source

Thrown at lib/puppet/util/windows/adsi.rb:320

    require_relative '../../../puppet/util/windows/sid'

    # https://msdn.microsoft.com/en-us/library/aa746340.aspx
    # IADsUser interface
    @object_class = 'user'

    class << self
      def list_all
        Puppet::Util::Windows::ADSI.execquery('select name from win32_useraccount where localaccount = "TRUE"')
      end

      def logon(name, password)
        Puppet::Util::Windows::User.password_is?(name, password)
      end

      def create(name)
        # Windows error 1379: The specified local group already exists.
        raise Puppet::Error, _("Cannot create user if group '%{name}' exists.") % { name: name } if Puppet::Util::Windows::ADSI::Group.exists? name

        new(name, Puppet::Util::Windows::ADSI.create(name, @object_class))
      end
    end

    def password_is?(password)
      self.class.logon(name, password)
    end

    def add_flag(flag_name, value)
      flag = begin
        native_object.Get(flag_name)
      rescue
        0
      end

      native_object.Put(flag_name, flag | value)

View on GitHub (pinned to e227c27540)

Solutions

1. Choose a different name for the user, or remove/rename the conflicting group first.
2. If Puppet manages both, decide which resource keeps the name and update all references.

Example fix

# before
group { 'app': ensure => present }
user  { 'app': ensure => present } # raises on Windows

# after
group { 'app': ensure => present }
user  { 'svc_app': ensure => present }

if Puppet::Util::Windows::ADSI::Group.exists?(name)
  raise ArgumentError, "name #{name.inspect} is taken by a local group"
end
Puppet::Util::Windows::ADSI::User.create(name)

When it happens

Trigger: A user resource whose title equals an existing local group name (user 'app' while group 'app' exists), including when a group resource earlier in the same catalog run created the colliding group.

Common situations: Porting Unix conventions where a user and its group share a name to Windows; refactoring a resource from group to user without removing or renaming the old group.

Related errors

• Cannot create group if user '%{name}' exists.
• Failed to get computer name
• Value must be in DOMAIN\\%{object_class} style syntax
• Could not resolve name: %{name}
• Puppet is not able to create/delete domain %{object_class} o

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/c7113c1889b05029. Report an issue: GitHub.