puppetlabs/puppet · error · Puppet::Error

Puppet is not able to create/delete domain %{object_class} o

Error message

Puppet is not able to create/delete domain %{object_class} objects with the %{object_class} resource.

What it means

Raised from ADSIObject#commit when the underlying OLE SetInfo call fails with ERROR_BAD_USERNAME (winerror 2202, HRESULT 0x8007089A). Puppet's user/group resources operate through the WinNT provider, which can enumerate but not create, modify, or delete domain objects — so when the target name resolves to a domain account, the write is rejected with this message.

Source

Thrown at lib/puppet/util/windows/adsi.rb:291

      @sid ||= Puppet::Util::Windows::SID.octet_string_to_principal(native_object.objectSID)
    end

    def [](attribute)
      # Setting WIN32OLE.codepage ensures values are returned as UTF-8
      native_object.Get(attribute)
    end

    def []=(attribute, value)
      native_object.Put(attribute, value)
    end

    def commit
      begin
        native_object.SetInfo
      rescue WIN32OLERuntimeError => e
        # ERROR_BAD_USERNAME 2202L from winerror.h
        if e.message =~ /8007089A/m
          raise Puppet::Error, _("Puppet is not able to create/delete domain %{object_class} objects with the %{object_class} resource.") % { object_class: object_class }
        end

        raise Puppet::Error.new(_("%{object_class} update failed: %{error}") % { object_class: object_class.capitalize, error: e }, e)
      end
      self
    end
  end

  class User < ADSIObject
    extend FFI::Library

    require_relative '../../../puppet/util/windows/sid'

    # https://msdn.microsoft.com/en-us/library/aa746340.aspx
    # IADsUser interface
    @object_class = 'user'

    class << self

View on GitHub (pinned to e227c27540)

Solutions

1. Use the built-in user/group resources only for local accounts: drop the DOMAIN\\ prefix or target a genuinely local name.
2. For AD objects, switch to AD-capable management (puppetlabs-dsc / PowerShell, or an AD-specific module).
3. If a local account of that name was intended, make sure the resource references the machine-local name explicitly.

Example fix

# before: local group resource pointed at a domain group
group { 'DOMAIN\\app-admins': ensure => present }

# after: manage a local group, or use DSC/PowerShell for the AD object
group { 'app-admins': ensure => present }

domain, _acct = name.split('\\')
local = [ENV['COMPUTERNAME'], Socket.gethostname].map(&:downcase)
if domain && !local.include?(domain.downcase)
  raise ArgumentError, "#{name.inspect} is a domain object; manage it with DSC/AD tooling, not the local user/group resource"
end

When it happens

Trigger: Declaring a puppet user or group resource whose name is a domain account ('DOMAIN\\app-admins', or a bare name that resolves against a trusted domain); any ensure/update/delete of such a name hits SetInfo and fails with 2202.

Common situations: Trying to manage AD users/groups with the built-in windows user/group types instead of AD tooling; machines where the local name slot is empty so lookup falls through to the domain.

Related errors

• Failed to get computer name
• Value must be in DOMAIN\\%{object_class} style syntax
• Could not resolve name: %{name}
• Cannot create user if group '%{name}' exists.
• Unrecognized ADS UserFlags: %{unrecognized_flags}

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/f8bcb1f69d305b82. Report an issue: GitHub.