Unable to run mcr.microsoft.com/windows/nanoserver:ltsc2025 based containers with custom users #640

Activity

1. Qasim Sajid (qasim-sajid-snkeos)

   added

   bugSomething isn't workingSomething isn't working

   triageNew and needs attentionNew and needs attention

   on Jul 14, 2026
2. github-actions commented on Jul 14, 2026

   

   github-actionsBot

   on Jul 14, 2026 – with GitHub Actions

   More actions

   Thank you for creating an Issue. Please note that GitHub is not an official channel for Microsoft support requests. To create an official support request, please open a ticket here. Microsoft and the GitHub Community strive to provide a best effort in answering questions and supporting Issues on GitHub.
3. rawahars commented on Jul 15, 2026

   

   Harsh Rawat (rawahars)

   on Jul 15, 2026

   More actions

   Root cause: nanoserver:ltsc2025 ships with an empty LSA "Primary Domain" name. A custom local user (net user) does a real local logon that requires this value to be non-empty, so it fails with ERROR_NO_SUCH_DOMAIN (0x54b). Built-in ContainerUser/ContainerAdministrator are virtual accounts that skip that path (so they work), and ltsc2022 sets the value to WORKGROUP (so it works there).

   Workarounds: use ContainerUser, or ltsc2022, or set a non-empty Primary Domain name at build time (before the USER switch) with a tiny helper.

   setpd.c (~15 lines):

   #include <windows.h>
   #include <ntsecapi.h>
   #include <wchar.h>
   
   int wmain(int argc, wchar_t **argv) {
       wchar_t *name = argc > 1 ? argv[1] : L"WORKGROUP";
       LSA_OBJECT_ATTRIBUTES oa = {0};
       LSA_HANDLE h;
       if (LsaOpenPolicy(0, &oa, POLICY_TRUST_ADMIN | POLICY_VIEW_LOCAL_INFORMATION, &h)) return 1;
       POLICY_PRIMARY_DOMAIN_INFO pd = {0};
       pd.Name.Buffer = name;
       pd.Name.Length = (USHORT)(wcslen(name) * 2);
       pd.Name.MaximumLength = pd.Name.Length + 2;
       return LsaSetInformationPolicy(h, PolicyPrimaryDomainInformation, &pd) ? 2 : 0;
   }

   Build a static exe (runs on Nano Server, no CRT deps):

   x86_64-w64-mingw32-gcc setpd.c -o setpd.exe -municode -ladvapi32 -static
   

   Fixed Dockerfile:

   FROM mcr.microsoft.com/windows/nanoserver:ltsc2025
   USER ContainerAdministrator
   RUN net accounts /MaxPWAge:unlimited && \
       net user /add "MyCustomUser" /expires:never && \
       net localgroup "Network Configuration Operators" "MyCustomUser" /add
   COPY setpd.exe C:\setpd.exe
   RUN C:\setpd.exe WORKGROUP
   USER MyCustomUser
   ENTRYPOINT ["CMD"]
4. qasim-sajid-snkeos commented on Jul 16, 2026

   

   Qasim Sajid (qasim-sajid-snkeos)

   on Jul 16, 2026

   Author

   More actions

   Harsh Rawat (@rawahars) thanks for the quick and detailed response.
   I tried your solution and it worked, so closing the issue.

   👍React with 👍1Reacted by Harsh Rawat
5. Qasim Sajid (qasim-sajid-snkeos)

   closed this as completedon Jul 16, 2026