Ask Your Question

exec not working on windows

asked 2015-09-01 16:45:13 -0600

R gravatar image

I have a simple class which will add a domain group "domain\netgroups" to the loca administrators group on a Windows server. When I run puppet apply I see the class finishing successfully but the group is not added to the admin group. I kindly request to let me know what am I missing.

Thanks a lot

class alter_admin_group {
$command="net localgroup Administrators domain\netgroups add"
 if $::osfamily == 'windows' {
  exec { 'Alter_Admin_group':
  command => "C:\\windows\\system32\\cmd.exe /c ${command}",
  group => 'Administrators',
edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2015-09-02 07:58:48 -0600

johnnyb04 gravatar image

updated 2015-09-02 08:00:50 -0600

In the past, my issues with executing on Windows have been with special characters and variable interpolation. I would suggest rewriting your code like this so your command is in one place. I'd also look at echoing your commands to see if Windows is reading them correctly. See below for my suggestion...

class alter_admin_group {
if $::osfamily == 'windows' {
exec { 'cmd.exe /c net localgroup Administrators domain\netgroups add':
  #Example-Try running the command cmd.exe /c echo "net localgroup Administrators domain\netgroups add" > C:\example.txt to see what is being passed to the system 
  path => $::path,
  group => 'Administrators',

I hope this helps.

edit flag offensive delete link more


Thanks for the response. I had tried this (including the command within exec) first and it did not work. There is definitely something wonky with puppet on windows. From my personal experience what I've seen is that puppet doesn't play very well with Windows.

R gravatar imageR ( 2015-09-02 16:48:34 -0600 )edit

answered 2015-09-02 22:05:53 -0600

Iristyle gravatar image

You should not need to use a class / exec to do this. The following manifest should be all that you need

group { 'Administrators':
  ensure   => present,
  members  => [ 'domain\netgroups' ],
  auth_membership => false

Note that prior to Puppet 3.8, the members property was considered authoritative and auth_membership didn't work properly - i.e. this would remove all the other members from the Administrators groups, instead of just making sure that Administrators includes domain\netgroups. The auth_membership support was fixed in 3.8, but still defaults to true to maintain backward compatibility in the 3.x line. In Puppet 4, the default for auth_membership was changed to false, and thus can be omitted from the manifest if you're using Puppet 4.

For more info on that old issue, please see and additional discussion at!top...

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2015-09-01 16:45:13 -0600

Seen: 364 times

Last updated: Sep 02 '15