puppetlabs/puppet · error · Puppet::Error

Could not resolve name: %{name}

Error message

Could not resolve name: %{name}

What it means

Raised by ADSIObject.name_sid_hash when Windows cannot translate a principal name to a SID: Puppet::Util::Windows::SID.name_to_principal returned nil. Puppet refuses to build permission sets for accounts it cannot resolve unless unresolved SIDs are explicitly permitted.

Source

Thrown at lib/puppet/util/windows/adsi.rb:194

          sids << Puppet::Util::Windows::SID.ads_to_principal(m)
        rescue Puppet::Util::Windows::Error => e
          case e.code
          when Puppet::Util::Windows::SID::ERROR_TRUSTED_RELATIONSHIP_FAILURE, Puppet::Util::Windows::SID::ERROR_TRUSTED_DOMAIN_FAILURE
            sids << Puppet::Util::Windows::SID.unresolved_principal(m.name, m.sid)
          else
            raise e
          end
        end

        sids
      end

      def name_sid_hash(names, allow_unresolved = false)
        return {} if names.nil? || names.empty?

        sids = names.map do |name|
          sid = Puppet::Util::Windows::SID.name_to_principal(name, allow_unresolved)
          raise Puppet::Error, _("Could not resolve name: %{name}") % { name: name } unless sid

          [sid.sid, sid]
        end

        sids.to_h
      end

      def delete(name)
        Puppet::Util::Windows::ADSI.delete(name, @object_class)
      end

      def exists?(name_or_sid)
        well_known = false
        if (sid = Puppet::Util::Windows::SID.name_to_principal(name_or_sid))
          # Examples of SidType include SidTypeUser, SidTypeGroup
          if sid.account_type == "SidType#{@object_class.capitalize}".to_sym
            # Check if we're getting back a local user when domain-joined
            return true unless [:MEMBER_WORKSTATION, :MEMBER_SERVER].include?(Puppet::Util::Windows::ADSI.domain_role)

View on GitHub (pinned to e227c27540)

Solutions

1. Verify each name on the node (`net user <name>`, `Get-ADGroupMember`) and fix typos or stale references.
2. Order the catalog so member accounts exist before the group resource (before/require).
3. Repair or rejoin the domain trust if every domain name fails to resolve.
4. If calling name_sid_hash directly and dangling SIDs are acceptable, pass allow_unresolved: true.

Example fix

# before
group { 'app-users': members => ['domian\\bob'] } # typo in domain

# after
group { 'app-users': members => ['DOMAIN\\bob'] }

members.each do |m|
  principal = Puppet::Util::Windows::SID.name_to_principal(m, true)
  raise ArgumentError, "member #{m.inspect} does not resolve to a SID" if principal.nil?
end
Puppet::Util::Windows::ADSI::Group.name_sid_hash(members)

begin
  sids = Puppet::Util::Windows::ADSI::Group.name_sid_hash(members)
rescue Puppet::Error => e
  raise "cannot resolve one of #{members.inspect}: #{e.message}"
end

When it happens

Trigger: A Windows group resource listing members that do not exist (typo, deleted account, untrusted domain), or a user resource referencing an unresolvable owner; name_sid_hash(members) during membership management with allow_unresolved left false.

Common situations: Group members created later in the run than the group itself; renamed or deleted AD accounts still referenced in manifests; disjoined machines or broken domain trust causing all domain-name resolution to fail.

Related errors

• Cannot create group if user '%{name}' exists.
• ads_object must be an IAdsUser or IAdsGroup instance
• Failed to get computer name
• Value must be in DOMAIN\\%{object_class} style syntax
• Puppet is not able to create/delete domain %{object_class} o

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/e34b42d1ead010ed. Report an issue: GitHub.