diff --git a/lib/puppet/provider/group/windows_adsi.rb b/lib/puppet/provider/group/windows_adsi.rb
index 76cd65805..ed8d1f76e 100644
--- a/lib/puppet/provider/group/windows_adsi.rb
+++ b/lib/puppet/provider/group/windows_adsi.rb
@@ -1,93 +1,100 @@
 require 'puppet/util/windows'
 
 Puppet::Type.type(:group).provide :windows_adsi do
   desc "Local group management for Windows. Group members can be both users and groups.
     Additionally, local groups can contain domain users."
 
   defaultfor :operatingsystem => :windows
   confine    :operatingsystem => :windows
 
   has_features :manages_members
 
+  def initialize(value={})
+    super(value)
+    @deleted = false
+  end
+
   def members_insync?(current, should)
     return false unless current
 
     # By comparing account SIDs we don't have to worry about case
     # sensitivity, or canonicalization of account names.
 
     # Cannot use munge of the group property to canonicalize @should
     # since the default array_matching comparison is not commutative
     should_empty = should.nil? or should.empty?
 
     return false if current.empty? != should_empty
 
     # dupes automatically weeded out when hashes built
     current_users = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current)
     specified_users = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should)
 
     if @resource[:auth_membership]
       current_users == specified_users
     else
       (specified_users.keys.to_a & current_users.keys.to_a) == specified_users.keys.to_a
     end
   end
 
   def members_to_s(users)
     return '' if users.nil? or !users.kind_of?(Array)
     users = users.map do |user_name|
       sid = Puppet::Util::Windows::SID.name_to_sid_object(user_name)
       if sid.account =~ /\\/
         account, _ = Puppet::Util::Windows::ADSI::User.parse_name(sid.account)
       else
         account = sid.account
       end
       resource.debug("#{sid.domain}\\#{account} (#{sid.to_s})")
       "#{sid.domain}\\#{account}"
     end
     return users.join(',')
   end
 
   def group
     @group ||= Puppet::Util::Windows::ADSI::Group.new(@resource[:name])
   end
 
   def members
     group.members
   end
 
   def members=(members)
     group.set_members(members, @resource[:auth_membership])
   end
 
   def create
     @group = Puppet::Util::Windows::ADSI::Group.create(@resource[:name])
     @group.commit
 
     self.members = @resource[:members]
   end
 
   def exists?
     Puppet::Util::Windows::ADSI::Group.exists?(@resource[:name])
   end
 
   def delete
     Puppet::Util::Windows::ADSI::Group.delete(@resource[:name])
+
+    @deleted = true
   end
 
   # Only flush if we created or modified a group, not deleted
   def flush
-    @group.commit if @group
+    @group.commit if @group && !@deleted
   end
 
   def gid
     Puppet::Util::Windows::SID.name_to_sid(@resource[:name])
   end
 
   def gid=(value)
     fail "gid is read-only"
   end
 
   def self.instances
     Puppet::Util::Windows::ADSI::Group.map { |g| new(:ensure => :present, :name => g.name) }
   end
 end
diff --git a/lib/puppet/provider/user/windows_adsi.rb b/lib/puppet/provider/user/windows_adsi.rb
index fbca8744b..20570b224 100644
--- a/lib/puppet/provider/user/windows_adsi.rb
+++ b/lib/puppet/provider/user/windows_adsi.rb
@@ -1,99 +1,106 @@
 require 'puppet/util/windows'
 
 Puppet::Type.type(:user).provide :windows_adsi do
   desc "Local user management for Windows."
 
   defaultfor :operatingsystem => :windows
   confine    :operatingsystem => :windows
 
   has_features :manages_homedir, :manages_passwords
 
+  def initialize(value={})
+    super(value)
+    @deleted = false
+  end
+
   def user
     @user ||= Puppet::Util::Windows::ADSI::User.new(@resource[:name])
   end
 
   def groups
     user.groups.join(',')
   end
 
   def groups=(groups)
     user.set_groups(groups, @resource[:membership] == :minimum)
   end
 
   def create
     @user = Puppet::Util::Windows::ADSI::User.create(@resource[:name])
     @user.password = @resource[:password]
     @user.commit
 
     [:comment, :home, :groups].each do |prop|
       send("#{prop}=", @resource[prop]) if @resource[prop]
     end
 
     if @resource.managehome?
       Puppet::Util::Windows::User.load_profile(@resource[:name], @resource[:password])
     end
   end
 
   def exists?
     Puppet::Util::Windows::ADSI::User.exists?(@resource[:name])
   end
 
   def delete
     # lookup sid before we delete account
     sid = uid if @resource.managehome?
 
     Puppet::Util::Windows::ADSI::User.delete(@resource[:name])
 
     if sid
       Puppet::Util::Windows::ADSI::UserProfile.delete(sid)
     end
+
+    @deleted = true
   end
 
   # Only flush if we created or modified a user, not deleted
   def flush
-    @user.commit if @user
+    @user.commit if @user && !@deleted
   end
 
   def comment
     user['Description']
   end
 
   def comment=(value)
     user['Description'] = value
   end
 
   def home
     user['HomeDirectory']
   end
 
   def home=(value)
     user['HomeDirectory'] = value
   end
 
   def password
     user.password_is?( @resource[:password] ) ? @resource[:password] : :absent
   end
 
   def password=(value)
     user.password = value
   end
 
   def uid
     Puppet::Util::Windows::SID.name_to_sid(@resource[:name])
   end
 
   def uid=(value)
     fail "uid is read-only"
   end
 
   [:gid, :shell].each do |prop|
     define_method(prop) { nil }
     define_method("#{prop}=") do |v|
       fail "No support for managing property #{prop} of user #{@resource[:name]} on Windows"
     end
   end
 
   def self.instances
     Puppet::Util::Windows::ADSI::User.map { |u| new(:ensure => :present, :name => u.name) }
   end
 end
diff --git a/spec/unit/provider/group/windows_adsi_spec.rb b/spec/unit/provider/group/windows_adsi_spec.rb
index 3c9329ee1..49316665f 100644
--- a/spec/unit/provider/group/windows_adsi_spec.rb
+++ b/spec/unit/provider/group/windows_adsi_spec.rb
@@ -1,200 +1,208 @@
 #!/usr/bin/env ruby
 
 require 'spec_helper'
 
 describe Puppet::Type.type(:group).provider(:windows_adsi), :if => Puppet.features.microsoft_windows? do
   let(:resource) do
     Puppet::Type.type(:group).new(
       :title => 'testers',
       :provider => :windows_adsi
     )
   end
 
   let(:provider) { resource.provider }
 
   let(:connection) { stub 'connection' }
 
   before :each do
     Puppet::Util::Windows::ADSI.stubs(:computer_name).returns('testcomputername')
     Puppet::Util::Windows::ADSI.stubs(:connect).returns connection
   end
 
   describe ".instances" do
     it "should enumerate all groups" do
       names = ['group1', 'group2', 'group3']
       stub_groups = names.map{|n| stub(:name => n)}
 
       connection.stubs(:execquery).with('select name from win32_group where localaccount = "TRUE"').returns stub_groups
 
       described_class.instances.map(&:name).should =~ names
     end
   end
 
   describe "group type :members property helpers" do
 
     let(:user1) { stub(:account => 'user1', :domain => '.', :to_s => 'user1sid') }
     let(:user2) { stub(:account => 'user2', :domain => '.', :to_s => 'user2sid') }
     let(:user3) { stub(:account => 'user3', :domain => '.', :to_s => 'user3sid') }
 
     before :each do
       Puppet::Util::Windows::SID.stubs(:name_to_sid_object).with('user1').returns(user1)
       Puppet::Util::Windows::SID.stubs(:name_to_sid_object).with('user2').returns(user2)
       Puppet::Util::Windows::SID.stubs(:name_to_sid_object).with('user3').returns(user3)
     end
 
     describe "#members_insync?" do
       it "should return false when current is nil" do
         provider.members_insync?(nil, ['user2']).should be_false
       end
 
       it "should return false when should is nil" do
         provider.members_insync?(['user1'], nil).should be_false
       end
 
       it "should return false for differing lists of members" do
         provider.members_insync?(['user1'], ['user2']).should be_false
         provider.members_insync?(['user1'], []).should be_false
         provider.members_insync?([], ['user2']).should be_false
       end
 
       it "should return true for same lists of members" do
         provider.members_insync?(['user1', 'user2'], ['user1', 'user2']).should be_true
       end
 
       it "should return true for same lists of unordered members" do
         provider.members_insync?(['user1', 'user2'], ['user2', 'user1']).should be_true
       end
 
       it "should return true for same lists of members irrespective of duplicates" do
         provider.members_insync?(['user1', 'user2', 'user2'], ['user2', 'user1', 'user1']).should be_true
       end
 
       context "when auth_membership => true" do
         before :each do
           # this is also the default
           resource[:auth_membership] = true
         end
 
         it "should return false when should user(s) are not the only items in the current" do
           provider.members_insync?(['user1', 'user2'], ['user1']).should be_false
         end
       end
 
       context "when auth_membership => false" do
         before :each do
           resource[:auth_membership] = false
         end
 
         it "should return true when current user(s) contains at least the should list" do
           provider.members_insync?(['user1','user2'], ['user1']).should be_true
           end
 
         it "should return true when current user(s) contains at least the should list, even unordered" do
           provider.members_insync?(['user3','user1','user2'], ['user2','user1']).should be_true
         end
       end
     end
 
     describe "#members_to_s" do
       it "should return an empty string on non-array input" do
         [Object.new, {}, 1, :symbol, ''].each do |input|
           provider.members_to_s(input).should be_empty
         end
       end
       it "should return an empty string on empty or nil users" do
         provider.members_to_s([]).should be_empty
         provider.members_to_s(nil).should be_empty
       end
       it "should return a user string like DOMAIN\\USER" do
         provider.members_to_s(['user1']).should == '.\user1'
       end
       it "should return a user string like DOMAIN\\USER,DOMAIN2\\USER2" do
         provider.members_to_s(['user1', 'user2']).should == '.\user1,.\user2'
       end
     end
   end
 
   describe "when managing members" do
     it "should be able to provide a list of members" do
       provider.group.stubs(:members).returns ['user1', 'user2', 'user3']
 
       provider.members.should =~ ['user1', 'user2', 'user3']
     end
 
     it "should be able to set group members" do
       provider.group.stubs(:members).returns ['user1', 'user2']
 
       member_sids = [
         stub(:account => 'user1', :domain => 'testcomputername'),
         stub(:account => 'user2', :domain => 'testcomputername'),
         stub(:account => 'user3', :domain => 'testcomputername'),
       ]
 
       provider.group.stubs(:member_sids).returns(member_sids[0..1])
 
       Puppet::Util::Windows::SID.expects(:name_to_sid_object).with('user2').returns(member_sids[1])
       Puppet::Util::Windows::SID.expects(:name_to_sid_object).with('user3').returns(member_sids[2])
 
       provider.group.expects(:remove_member_sids).with(member_sids[0])
       provider.group.expects(:add_member_sids).with(member_sids[2])
 
       provider.members = ['user2', 'user3']
     end
   end
 
   describe 'when creating groups' do
     it "should be able to create a group" do
       resource[:members] = ['user1', 'user2']
 
       group = stub 'group'
       Puppet::Util::Windows::ADSI::Group.expects(:create).with('testers').returns group
 
       create = sequence('create')
       group.expects(:commit).in_sequence(create)
       group.expects(:set_members).with(['user1', 'user2'], true).in_sequence(create)
 
       provider.create
     end
 
     it 'should not create a group if a user by the same name exists' do
       Puppet::Util::Windows::ADSI::Group.expects(:create).with('testers').raises( Puppet::Error.new("Cannot create group if user 'testers' exists.") )
       expect{ provider.create }.to raise_error( Puppet::Error,
         /Cannot create group if user 'testers' exists./ )
     end
 
     it 'should commit a newly created group' do
       provider.group.expects( :commit )
 
       provider.flush
     end
   end
 
   it "should be able to test whether a group exists" do
     Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
     Puppet::Util::Windows::ADSI.stubs(:connect).returns stub('connection')
     provider.should be_exists
 
     Puppet::Util::Windows::ADSI.stubs(:connect).returns nil
     provider.should_not be_exists
   end
 
   it "should be able to delete a group" do
     connection.expects(:Delete).with('group', 'testers')
 
     provider.delete
   end
 
+  it 'should not run commit on a deleted group' do
+    connection.expects(:Delete).with('group', 'testers')
+    connection.expects(:SetInfo).never
+
+    provider.delete
+    provider.flush
+  end
+
   it "should report the group's SID as gid" do
     Puppet::Util::Windows::SID.expects(:name_to_sid).with('testers').returns('S-1-5-32-547')
     provider.gid.should == 'S-1-5-32-547'
   end
 
   it "should fail when trying to manage the gid property" do
     provider.expects(:fail).with { |msg| msg =~ /gid is read-only/ }
     provider.send(:gid=, 500)
   end
 
   it "should prefer the domain component from the resolved SID" do
     provider.members_to_s(['.\Administrators']).should == 'BUILTIN\Administrators'
   end
 end
diff --git a/spec/unit/provider/user/windows_adsi_spec.rb b/spec/unit/provider/user/windows_adsi_spec.rb
index 84aa8a74c..13f98fe52 100755
--- a/spec/unit/provider/user/windows_adsi_spec.rb
+++ b/spec/unit/provider/user/windows_adsi_spec.rb
@@ -1,173 +1,181 @@
 #!/usr/bin/env ruby
 
 require 'spec_helper'
 
 describe Puppet::Type.type(:user).provider(:windows_adsi), :if => Puppet.features.microsoft_windows? do
   let(:resource) do
     Puppet::Type.type(:user).new(
       :title => 'testuser',
       :comment => 'Test J. User',
       :provider => :windows_adsi
     )
   end
 
   let(:provider) { resource.provider }
 
   let(:connection) { stub 'connection' }
 
   before :each do
     Puppet::Util::Windows::ADSI.stubs(:computer_name).returns('testcomputername')
     Puppet::Util::Windows::ADSI.stubs(:connect).returns connection
   end
 
   describe ".instances" do
     it "should enumerate all users" do
       names = ['user1', 'user2', 'user3']
       stub_users = names.map{|n| stub(:name => n)}
       connection.stubs(:execquery).with('select name from win32_useraccount where localaccount = "TRUE"').returns(stub_users)
 
       described_class.instances.map(&:name).should =~ names
     end
   end
 
   it "should provide access to a Puppet::Util::Windows::ADSI::User object" do
     provider.user.should be_a(Puppet::Util::Windows::ADSI::User)
   end
 
   describe "when managing groups" do
     it 'should return the list of groups as a comma-separated list' do
       provider.user.stubs(:groups).returns ['group1', 'group2', 'group3']
 
       provider.groups.should == 'group1,group2,group3'
     end
 
     it "should return absent if there are no groups" do
       provider.user.stubs(:groups).returns []
 
       provider.groups.should == ''
     end
 
     it 'should be able to add a user to a set of groups' do
       resource[:membership] = :minimum
       provider.user.expects(:set_groups).with('group1,group2', true)
 
       provider.groups = 'group1,group2'
 
       resource[:membership] = :inclusive
       provider.user.expects(:set_groups).with('group1,group2', false)
 
       provider.groups = 'group1,group2'
     end
   end
 
   describe "when creating a user" do
     it "should create the user on the system and set its other properties" do
       resource[:groups]     = ['group1', 'group2']
       resource[:membership] = :inclusive
       resource[:comment]    = 'a test user'
       resource[:home]       = 'C:\Users\testuser'
 
       user = stub 'user'
       Puppet::Util::Windows::ADSI::User.expects(:create).with('testuser').returns user
 
       user.stubs(:groups).returns(['group2', 'group3'])
 
       create = sequence('create')
       user.expects(:password=).in_sequence(create)
       user.expects(:commit).in_sequence(create)
       user.expects(:set_groups).with('group1,group2', false).in_sequence(create)
       user.expects(:[]=).with('Description', 'a test user')
       user.expects(:[]=).with('HomeDirectory', 'C:\Users\testuser')
 
       provider.create
     end
 
     it "should load the profile if managehome is set" do
       resource[:password] = '0xDeadBeef'
       resource[:managehome] = true
 
       user = stub_everything 'user'
       Puppet::Util::Windows::ADSI::User.expects(:create).with('testuser').returns user
       Puppet::Util::Windows::User.expects(:load_profile).with('testuser', '0xDeadBeef')
 
       provider.create
     end
 
     it "should set a user's password" do
       provider.user.expects(:password=).with('plaintextbad')
 
       provider.password = "plaintextbad"
     end
 
     it "should test a valid user password" do
       resource[:password] = 'plaintext'
       provider.user.expects(:password_is?).with('plaintext').returns true
 
       provider.password.should == 'plaintext'
 
     end
 
     it "should test a bad user password" do
       resource[:password] = 'plaintext'
       provider.user.expects(:password_is?).with('plaintext').returns false
 
       provider.password.should == :absent
     end
 
     it 'should not create a user if a group by the same name exists' do
       Puppet::Util::Windows::ADSI::User.expects(:create).with('testuser').raises( Puppet::Error.new("Cannot create user if group 'testuser' exists.") )
       expect{ provider.create }.to raise_error( Puppet::Error,
         /Cannot create user if group 'testuser' exists./ )
     end
   end
 
   it 'should be able to test whether a user exists' do
     Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
     Puppet::Util::Windows::ADSI.stubs(:connect).returns stub('connection')
     provider.should be_exists
 
     Puppet::Util::Windows::ADSI.stubs(:connect).returns nil
     provider.should_not be_exists
   end
 
   it 'should be able to delete a user' do
     connection.expects(:Delete).with('user', 'testuser')
 
     provider.delete
   end
 
+  it 'should not run commit on a deleted user' do
+    connection.expects(:Delete).with('user', 'testuser')
+    connection.expects(:SetInfo).never
+
+    provider.delete
+    provider.flush
+  end
+
   it 'should delete the profile if managehome is set' do
     resource[:managehome] = true
 
     sid = 'S-A-B-C'
     Puppet::Util::Windows::SID.expects(:name_to_sid).with('testuser').returns(sid)
     Puppet::Util::Windows::ADSI::UserProfile.expects(:delete).with(sid)
     connection.expects(:Delete).with('user', 'testuser')
 
     provider.delete
   end
 
   it "should commit the user when flushed" do
     provider.user.expects(:commit)
 
     provider.flush
   end
 
   it "should return the user's SID as uid" do
     Puppet::Util::Windows::SID.expects(:name_to_sid).with('testuser').returns('S-1-5-21-1362942247-2130103807-3279964888-1111')
 
     provider.uid.should == 'S-1-5-21-1362942247-2130103807-3279964888-1111'
   end
 
   it "should fail when trying to manage the uid property" do
     provider.expects(:fail).with { |msg| msg =~ /uid is read-only/ }
     provider.send(:uid=, 500)
   end
 
   [:gid, :shell].each do |prop|
     it "should fail when trying to manage the #{prop} property" do
       provider.expects(:fail).with { |msg| msg =~ /No support for managing property #{prop}/ }
       provider.send("#{prop}=", 'foo')
     end
   end
 end