Hi, The files `ossec-hids-local.spec`, `ossec-hids-agent.spec` and `ossec-hids-server.spec` generate the group and the user. ``` /usr/sbin/groupadd ossec /usr/sbin/useradd -d /var/ossec -s /bin/false -g ossec ${USER} ``` This is now generated in user space. If you have ldap generated users this might and will cause a clash. Is it not better to use: ``` /usr/sbin/groupadd --system ossec /usr/sbin/useradd --system -d /var/ossec -s /bin/false -g ossec ${USER} ``` This way the ossec group and user are created in system space.