diff --git a/spec/unit/provider/user/user_role_add_spec.rb b/spec/unit/provider/user/user_role_add_spec.rb
index 9cf649267..f73942389 100644
--- a/spec/unit/provider/user/user_role_add_spec.rb
+++ b/spec/unit/provider/user/user_role_add_spec.rb
@@ -1,266 +1,267 @@
 #!/usr/bin/env ruby
 
 require File.dirname(__FILE__) + '/../../../spec_helper'
 
 provider_class = Puppet::Type.type(:user).provider(:user_role_add)
 
 describe provider_class do
   before do
     @resource = stub("resource", :name => "myuser", :managehome? => nil)
     @resource.stubs(:should).returns "fakeval"
     @resource.stubs(:[]).returns "fakeval"
     @resource.stubs(:allowdupe?).returns false
     @provider = provider_class.new(@resource)
   end
 
   describe "when calling command" do
     before do
       klass = stub("provider")
       klass.stubs(:command).with(:foo).returns("userfoo")
       klass.stubs(:command).with(:role_foo).returns("rolefoo")
       @provider.stubs(:class).returns(klass)
     end
 
     it "should use the command if not a role and ensure!=role" do
       @provider.stubs(:is_role?).returns(false)
       @provider.stubs(:exists?).returns(false)
       @resource.stubs(:[]).with(:ensure).returns(:present)
       @provider.command(:foo).should == "userfoo"
     end
 
     it "should use the role command when a role" do
       @provider.stubs(:is_role?).returns(true)
       @provider.command(:foo).should == "rolefoo"
     end
 
     it "should use the role command when !exists and ensure=role" do
       @provider.stubs(:is_role?).returns(false)
       @provider.stubs(:exists?).returns(false)
       @resource.stubs(:[]).with(:ensure).returns(:role)
       @provider.command(:foo).should == "rolefoo"
     end
   end
 
   describe "when calling transition" do
     it "should return the type set to whatever is passed in" do
       @provider.expects(:command).with(:modify).returns("foomod")
       @provider.transition("bar").include?("type=bar")
     end
   end
 
   describe "when calling create" do
     before do
       @provider.stubs(:password=)
     end
 
     it "should use the add command when the user is not a role" do
       @provider.stubs(:is_role?).returns(false)
       @provider.expects(:addcmd).returns("useradd")
       @provider.expects(:run).at_least_once
       @provider.create
     end
 
     it "should use transition(normal) when the user is a role" do
       @provider.stubs(:is_role?).returns(true)
       @provider.expects(:transition).with("normal")
       @provider.expects(:run)
       @provider.create
     end
 
     it "should set password age rules" do
       @resource = Puppet::Type.type(:user).new :name => "myuser", :password_min_age => 5, :password_max_age => 10, :provider => :user_role_add
       @provider = provider_class.new(@resource)
       @provider.stubs(:user_attributes)
       @provider.stubs(:execute)
       @provider.expects(:execute).with { |cmd, *args| args == ["-n", 5, "-x", 10, "myuser"] }
       @provider.create
     end
   end
 
   describe "when calling destroy" do
     it "should use the delete command if the user exists and is not a role" do
       @provider.stubs(:exists?).returns(true)
       @provider.stubs(:is_role?).returns(false)
       @provider.expects(:deletecmd)
       @provider.expects(:run)
       @provider.destroy
     end
 
     it "should use the delete command if the user is a role" do
       @provider.stubs(:exists?).returns(true)
       @provider.stubs(:is_role?).returns(true)
       @provider.expects(:deletecmd)
       @provider.expects(:run)
       @provider.destroy
     end
   end
 
   describe "when calling create_role" do
     it "should use the transition(role) if the user exists" do
       @provider.stubs(:exists?).returns(true)
       @provider.stubs(:is_role?).returns(false)
       @provider.expects(:transition).with("role")
       @provider.expects(:run)
       @provider.create_role
     end
 
     it "should use the add command when role doesn't exists" do
       @provider.stubs(:exists?).returns(false)
       @provider.expects(:addcmd)
       @provider.expects(:run)
       @provider.create_role
     end
   end
 
   describe "when allow duplicate is enabled" do
     before do
       @resource.expects(:allowdupe?).returns true
+      @resource.stubs(:system?)
       @provider.stubs(:is_role?).returns(false)
       @provider.stubs(:execute)
       @provider.expects(:execute).with { |args| args.include?("-o") }
     end
 
     it "should add -o when the user is being created" do
       @provider.stubs(:password=)
       @provider.create
     end
 
     it "should add -o when the uid is being modified" do
       @provider.uid = 150
     end
   end
 
   [:roles, :auths, :profiles].each do |val|
     describe "when getting #{val}" do
       it "should get the user_attributes" do
         @provider.expects(:user_attributes)
         @provider.send(val)
       end
 
       it "should get the #{val} attribute" do
         attributes = mock("attributes")
         attributes.expects(:[]).with(val)
         @provider.stubs(:user_attributes).returns(attributes)
         @provider.send(val)
       end
     end
   end
 
   describe "when getting the keys" do
     it "should get the user_attributes" do
       @provider.expects(:user_attributes)
       @provider.keys
     end
 
     it "should call removed_managed_attributes" do
       @provider.stubs(:user_attributes).returns({ :type => "normal", :foo => "something" })
       @provider.expects(:remove_managed_attributes)
       @provider.keys
     end
 
     it "should removed managed attribute (type, auths, roles, etc)" do
       @provider.stubs(:user_attributes).returns({ :type => "normal", :foo => "something" })
       @provider.keys.should == { :foo => "something" }
     end
   end
 
   describe "when adding properties" do
     it "should call build_keys_cmd" do
       @resource.stubs(:should).returns ""
       @resource.expects(:should).with(:keys).returns({ :foo => "bar" })
       @provider.expects(:build_keys_cmd).returns([])
       @provider.add_properties
     end
 
     it "should add the elements of the keys hash to an array" do
       @resource.stubs(:should).returns ""
       @resource.expects(:should).with(:keys).returns({ :foo => "bar"})
       @provider.add_properties.must == ["-K", "foo=bar"]
     end
   end
 
   describe "when calling build_keys_cmd" do
     it "should build cmd array with keypairs seperated by -K ending with user" do
       @provider.build_keys_cmd({"foo" => "bar", "baz" => "boo"}).should.eql? ["-K", "foo=bar", "-K", "baz=boo"]
     end
   end
 
   describe "when setting the keys" do
     before do
       @provider.stubs(:is_role?).returns(false)
     end
 
     it "should run a command" do
       @provider.expects(:run)
       @provider.keys=({})
     end
 
     it "should build the command" do
       @resource.stubs(:[]).with(:name).returns("someuser")
       @provider.stubs(:command).returns("usermod")
       @provider.expects(:build_keys_cmd).returns(["-K", "foo=bar"])
       @provider.expects(:run).with(["usermod", "-K", "foo=bar", "someuser"], "modify attribute key pairs")
       @provider.keys=({})
     end
   end
 
   describe "when getting the hashed password" do
     before do
       @array = mock "array"
     end
 
     it "should readlines of /etc/shadow" do
       File.expects(:readlines).with("/etc/shadow").returns([])
       @provider.password
     end
 
     it "should reject anything that doesn't start with alpha numerics" do
       @array.expects(:reject).returns([])
       File.stubs(:readlines).with("/etc/shadow").returns(@array)
       @provider.password
     end
 
     it "should collect splitting on ':'" do
       @array.stubs(:reject).returns(@array)
       @array.expects(:collect).returns([])
       File.stubs(:readlines).with("/etc/shadow").returns(@array)
       @provider.password
     end
 
     it "should find the matching user" do
       @resource.stubs(:[]).with(:name).returns("username")
       @array.stubs(:reject).returns(@array)
       @array.stubs(:collect).returns([["username", "hashedpassword"], ["someoneelse", "theirpassword"]])
       File.stubs(:readlines).with("/etc/shadow").returns(@array)
       @provider.password.must == "hashedpassword"
     end
 
     it "should get the right password" do
       @resource.stubs(:[]).with(:name).returns("username")
       File.stubs(:readlines).with("/etc/shadow").returns(["#comment", "   nonsense", "  ", "username:hashedpassword:stuff:foo:bar:::", "other:pword:yay:::"])
       @provider.password.must == "hashedpassword"
     end
   end
 
   describe "when setting the password" do
     #how can you mock these blocks up?
     it "should open /etc/shadow for reading and /etc/shadow_tmp for writing" do
       File.expects(:open).with("/etc/shadow", "r")
       File.stubs(:rename)
       @provider.password=("hashedpassword")
     end
 
     it "should rename the /etc/shadow_tmp to /etc/shadow" do
       File.stubs(:open).with("/etc/shadow", "r")
       File.expects(:rename).with("/etc/shadow_tmp", "/etc/shadow")
       @provider.password=("hashedpassword")
     end
   end
 
   describe "#shadow_entry" do
     it "should return the line for the right user" do
       File.stubs(:readlines).returns(["someuser:!:10:5:20:7:1::\n", "fakeval:*:20:10:30:7:2::\n", "testuser:*:30:15:40:7:3::\n"])
       @provider.shadow_entry.should == ["fakeval", "*", "20", "10", "30", "7", "2"]
     end
   end
 end
diff --git a/spec/unit/provider/user/useradd_spec.rb b/spec/unit/provider/user/useradd_spec.rb
index 81ad7d400..fd75c43f3 100755
--- a/spec/unit/provider/user/useradd_spec.rb
+++ b/spec/unit/provider/user/useradd_spec.rb
@@ -1,209 +1,216 @@
 #!/usr/bin/env ruby
 
 require File.dirname(__FILE__) + '/../../../spec_helper'
 
 provider_class = Puppet::Type.type(:user).provider(:useradd)
 
 describe provider_class do
   before do
     @resource = stub("resource", :name => "myuser", :managehome? => nil)
     @resource.stubs(:should).returns "fakeval"
     @resource.stubs(:[]).returns "fakeval"
     @provider = provider_class.new(@resource)
   end
 
   # #1360
   it "should add -o when allowdupe is enabled and the user is being created" do
     @resource.expects(:allowdupe?).returns true
     @resource.expects(:system?).returns true
     @provider.stubs(:execute)
     @provider.expects(:execute).with { |args| args.include?("-o") }
     @provider.create
   end
 
   it "should add -o when allowdupe is enabled and the uid is being modified" do
     @resource.expects(:allowdupe?).returns true
     @provider.expects(:execute).with { |args| args.include?("-o") }
 
     @provider.uid = 150
   end
 
   it "should add -r when system is enabled" do
     @resource.expects(:allowdupe?).returns true
     @resource.expects(:system?).returns true
     @provider.stubs(:execute)
     @provider.expects(:execute).with { |args| args.include?("-r") }
     @provider.create
   end
 
   it "should set password age rules" do
     provider_class.has_feature :manages_password_age
     @resource = Puppet::Type.type(:user).new :name => "myuser", :password_min_age => 5, :password_max_age => 10, :provider => :useradd
     @provider = provider_class.new(@resource)
     @provider.stubs(:execute)
     @provider.expects(:execute).with { |cmd, *args| args == ["-m", 5, "-M", 10, "myuser"] }
     @provider.create
   end
 
   describe "when checking to add allow dup" do
     it "should check allow dup" do
       @resource.expects(:allowdupe?)
       @provider.check_allow_dup
     end
 
     it "should return an array with a flag if dup is allowed" do
       @resource.stubs(:allowdupe?).returns true
       @provider.check_allow_dup.must == ["-o"]
     end
 
     it "should return an empty array if no dup is allowed" do
       @resource.stubs(:allowdupe?).returns false
       @provider.check_allow_dup.must == []
     end
   end
 
   describe "when checking to add system users" do
     it "should check system users" do
       @resource.expects(:system?)
       @provider.check_system_users
     end
 
     it "should return an array with a flag if it's a system user" do
       @resource.stubs(:system?).returns true
       @provider.check_system_users.must == ["-r"]
     end
 
     it "should return an empty array if it's not a system user" do
       @resource.stubs(:system?).returns false
       @provider.check_system_users.must == []
     end
   end
 
   describe "when checking manage home" do
     it "should check manage home" do
       @resource.expects(:managehome?)
       @provider.check_manage_home
     end
 
     it "should return an array with -m flag if home is managed" do
       @resource.stubs(:managehome?).returns true
       @provider.check_manage_home.must == ["-m"]
     end
 
     it "should return an array with -M if home is not managed and on Redhat" do
       Facter.stubs(:value).with("operatingsystem").returns("RedHat")
       @resource.stubs(:managehome?).returns false
       @provider.check_manage_home.must == ["-M"]
     end
 
     it "should return an empty array if home is not managed and not on Redhat" do
       Facter.stubs(:value).with("operatingsystem").returns("some OS")
       @resource.stubs(:managehome?).returns false
       @provider.check_manage_home.must == []
     end
   end
 
   describe "when adding properties" do
     it "should get the valid properties"
     it "should not add the ensure property"
     it "should add the flag and value to an array"
     it "should return and array of flags and values"
   end
 
   describe "when calling addcmd" do
     before do
       @resource.stubs(:allowdupe?).returns true
       @resource.stubs(:managehome?).returns true
       @resource.stubs(:system?).returns true
     end
 
     it "should call command with :add" do
       @provider.expects(:command).with(:add)
       @provider.addcmd
     end
 
     it "should add properties" do
       @provider.expects(:add_properties).returns([])
       @provider.addcmd
     end
 
     it "should check and add if dup allowed" do
       @provider.expects(:check_allow_dup).returns([])
       @provider.addcmd
     end
 
-    it "should check and add if it's a system user" do
-      @provider.expects(:check_system_users).returns([])
-      @provider.addcmd
-    end
-
     it "should check and add if home is managed" do
       @provider.expects(:check_manage_home).returns([])
       @provider.addcmd
     end
 
     it "should add the resource :name" do
       @resource.expects(:[]).with(:name)
       @provider.addcmd
     end
 
+    it "should return an array with -r if system? is true" do
+      resource = Puppet::Type.type(:user).new( :name => "bob", :system => true)
+
+      provider_class.new( resource ).addcmd.should include("-r")
+    end
+
+    it "should return an array without -r if system? is false" do
+      resource = Puppet::Type.type(:user).new( :name => "bob", :system => false)
+
+      provider_class.new( resource ).addcmd.should_not include("-r")
+    end
+
     it "should return an array with full command" do
       @provider.stubs(:command).with(:add).returns("useradd")
       @provider.stubs(:add_properties).returns(["-G", "somegroup"])
       @resource.stubs(:[]).with(:name).returns("someuser")
       @resource.stubs(:[]).with(:expiry).returns("somedate")
       @provider.addcmd.must == ["useradd", "-G", "somegroup", "-o", "-m", '-e somedate', "-r", "someuser"]
     end
 
     it "should return an array without -e if expiry is undefined full command" do
       @provider.stubs(:command).with(:add).returns("useradd")
       @provider.stubs(:add_properties).returns(["-G", "somegroup"])
       @resource.stubs(:[]).with(:name).returns("someuser")
       @resource.stubs(:[]).with(:expiry).returns nil
       @provider.addcmd.must == ["useradd", "-G", "somegroup", "-o", "-m", "-r", "someuser"]
     end
   end
 
   describe "when calling passcmd" do
     before do
       @resource.stubs(:allowdupe?).returns true
       @resource.stubs(:managehome?).returns true
       @resource.stubs(:system?).returns true
     end
 
     it "should call command with :pass" do
       @provider.expects(:command).with(:password)
       @provider.passcmd
     end
 
     it "should return nil if neither min nor max is set" do
       @resource.stubs(:should).with(:password_min_age).returns nil
       @resource.stubs(:should).with(:password_max_age).returns nil
       @provider.passcmd.must == nil
     end
 
     it "should return a chage command array with -m <value> and the user name if password_min_age is set" do
       @provider.stubs(:command).with(:password).returns("chage")
       @resource.stubs(:[]).with(:name).returns("someuser")
       @resource.stubs(:should).with(:password_min_age).returns 123
       @resource.stubs(:should).with(:password_max_age).returns nil
       @provider.passcmd.must == ['chage','-m',123,'someuser']
     end
 
     it "should return a chage command array with -M <value> if password_max_age is set" do
       @provider.stubs(:command).with(:password).returns("chage")
       @resource.stubs(:[]).with(:name).returns("someuser")
       @resource.stubs(:should).with(:password_min_age).returns nil
       @resource.stubs(:should).with(:password_max_age).returns 999
       @provider.passcmd.must == ['chage','-M',999,'someuser']
     end
 
     it "should return a chage command array with -M <value> -m <value> if both password_min_age and password_max_age are set" do
       @provider.stubs(:command).with(:password).returns("chage")
       @resource.stubs(:[]).with(:name).returns("someuser")
       @resource.stubs(:should).with(:password_min_age).returns 123
       @resource.stubs(:should).with(:password_max_age).returns 999
       @provider.passcmd.must == ['chage','-m',123,'-M',999,'someuser']
     end
   end
 end