puppetlabs/puppet · error · Puppet::Error

Value must be in DOMAIN\\%{object_class} style syntax

Error message

Value must be in DOMAIN\\%{object_class} style syntax

What it means

Raised by ADSIObject.parse_name when the account name contains a forward slash. The WinNT provider used by Puppet's local user/group code expects DOMAIN\\account syntax (backslash) or a bare name; a '/' indicates URI-style ('WinNT://...') or LDAP-style input that cannot be interpreted, so it is rejected before any directory lookup.

Source

Thrown at lib/puppet/util/windows/adsi.rb:161

      def localized_domains
        @localized_domains ||= [
          # localized version of BUILTIN
          # for instance VORDEFINIERT on German Windows
          Puppet::Util::Windows::SID.sid_to_name('S-1-5-32').upcase,
          # localized version of NT AUTHORITY (can't use S-1-5)
          # for instance AUTORITE NT on French Windows
          Puppet::Util::Windows::SID.name_to_principal('SYSTEM').domain.upcase
        ]
      end

      def uri(name, host = '.')
        host = '.' if (localized_domains << Socket.gethostname.upcase).include?(host.upcase)
        Puppet::Util::Windows::ADSI.uri(name, @object_class, host)
      end

      def parse_name(name)
        if name =~ %r{/}
          raise Puppet::Error, _("Value must be in DOMAIN\\%{object_class} style syntax") % { object_class: @object_class }
        end

        matches = name.scan(/((.*)\\)?(.*)/)
        domain = matches[0][1] || '.'
        account = matches[0][2]

        [account, domain]
      end

      # returns Puppet::Util::Windows::SID::Principal[]
      # may contain objects that represent unresolvable SIDs
      def get_sids(adsi_child_collection)
        sids = []
        adsi_child_collection.each do |m|
          sids << Puppet::Util::Windows::SID.ads_to_principal(m)
        rescue Puppet::Util::Windows::Error => e
          case e.code
          when Puppet::Util::Windows::SID::ERROR_TRUSTED_RELATIONSHIP_FAILURE, Puppet::Util::Windows::SID::ERROR_TRUSTED_DOMAIN_FAILURE

View on GitHub (pinned to e227c27540)

Solutions

1. Use backslash syntax 'DOMAIN\\bob', or just the bare account name for local accounts.
2. Strip path-like prefixes and URI wrappers when generating names programmatically.

Example fix

# before
Puppet::Util::Windows::ADSI::User.exists?('DOMAIN/bob')

# after
Puppet::Util::Windows::ADSI::User.exists?('DOMAIN\\bob')

raise ArgumentError, "ADSI names must use DOMAIN\\account, got #{name.inspect}" if name.include?('/')
name = name.tr('/', '\\\\') # normalize accidental forward slashes
Puppet::Util::Windows::ADSI::User.exists?(name)

def valid_adsi_name?(n)
  n.is_a?(String) && !n.empty? && !n.include?('/')
end

When it happens

Trigger: Passing 'DOMAIN/bob' or 'computer/user' to Puppet::Util::Windows::ADSI::User or Group helpers (exists?, create, []) which route through parse_name; declaring a puppet user/group resource whose name contains '/'.

Common situations: Porting Unix manifests where '/' in names is harmless; generating account names from file paths or URLs; pasting LDAP DNs or WinNT URIs instead of flat account names.

Related errors

• Unrecognized ADS UserFlags: %{unrecognized_flags}
• ads_object must be an IAdsUser or IAdsGroup instance
• Passwords cannot include ':'
• Failed to get computer name
• Could not resolve name: %{name}

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/19f90fa736ee930e. Report an issue: GitHub.