The `service_group_available?` method ends up creating a group resource, and asking the group if it exists:

<pre>
  def exists?
    Puppet::Util::ADSI::Group.exists?(@resource[:name])
  end
</pre>

This always returns false for `Service`. Apparently, ADSI doesn't consider groups of type `SidTypeWellKnownGroup` to be a group. We then fallback to `Service`, so everything works, but it's not super intuitive. It does mean you can't specify the group to be a wellknowngroup, e.g. `Authenticated Users`, but I don't think that matters.