status=216/GROUP

On a Type=simple unit, systemctl start can exit 0 while the unit is failed. I hit that on systemd 255.4 on 2026-10-19 with a Group= name getent group does not find, and ExecStart=/bin/true. systemd-analyze verify exited 0 and printed nothing. The journal said Failed to determine group credentials: No such process, then status=216/GROUP. ExecMainStatus=216, Result=exit-code. The shell printed nothing. The units lived under /run and were removed. The remote-control unit that was already running stayed active. I did not start it.

216 is a group. 217 is a user.

What the unit had	verify	systemctl start	Result
`Group=` set to a name `getent group` does not find. Default `Type=simple`.	Exit 0. No output.	Exit 0. No output.	`status=216/GROUP`. Journal: `Failed to determine group credentials: No such process`.
`Group=59999`. `getent group 59999` prints nothing.	Exit 0. No output.	Exit 0.	Same journal sentence. `status=216/GROUP`.
`Type=oneshot` and the same missing group name.	Exit 0. No output.	Exit 1. The shell said the control process exited with an error code.	`ExecMainStatus=216`.
`User=59999`. `getent passwd 59999` prints nothing.	Exit 0. No output.	Exit 0.	`status=217/USER`. Journal: `Failed to determine user credentials: No such process`.
Both `User=` and `Group=` set to names that are not in the databases.	Exit 0. No output.	Exit 0.	`status=217/USER` only. The journal did not mention the group.
`DynamicUser=yes`. Also with a `User=` name that is not in passwd. Also with a `Group=` name that is not in the group database.	Exit 0. No output.	Exit 0.	`Result=success`. Journal: `Deactivated successfully.`

A missing user by name, and the words "No such process" rather than "no such user", are on the status=203/EXEC note. A numeric id that getent cannot find is the same status as a missing name. DynamicUser=yes is not a missing account. Those three runs started /bin/true and finished.

status=200/CHDIR is three different sentences

The 203 note's missing directory said No such file or directory. These are the other results from the same systemd, still status=200/CHDIR unless the path is not absolute or it has a leading -.

What the unit had	verify	Start
`User=nobody`, `WorkingDirectory=/root`, `ExecStart=/bin/true`	Exit 0. `Special user nobody configured, this is not safe!`	`Changing to the requested working directory failed: Permission denied`, then `status=200/CHDIR`. `systemctl start` exited 0.
`WorkingDirectory=/bin/true`	Exit 0. No output.	`Not a directory`, then `status=200/CHDIR`. `systemctl start` exited 0.
`WorkingDirectory=` set to a relative path	Exit 1. `WorkingDirectory= path is not absolute`	The start command exited 1. `Result=success`, `ExecMainStatus=0`, `ActiveState=inactive`. Not 200.
`WorkingDirectory=-/root` and `User=nobody`	Exit 0, plus the nobody warning	`Deactivated successfully.` The journal did not say permission denied.
`WorkingDirectory=-/bin/true`	Exit 0. No output.	`Deactivated successfully.` The journal did not say `Not a directory`.
`WorkingDirectory=-` plus a relative path	Exit 0. `path is not absolute, ignoring`	The unit started. The relative path was not a fatal error.

User=nobody with Group=nogroup and ExecStart=/bin/true also drew the nobody warning, and then Deactivated successfully. The warning is not the failure. I used nobody because that account already existed. The warning says not to.

When 203 does say permission denied

The mode-644 file on the 203 note had no User=. That journal did not say permission denied. Two later runs did not match that sentence.

A mode-700 root-owned copy of /bin/true, with User=nobody, logged Failed to execute that path, Permission denied, then status=203/EXEC. verify exited 0 and printed the nobody warning. systemctl start exited 0.

The same file with DynamicUser=yes and no User= was also status=203/EXEC. verify exited 0 and printed nothing. The journal did not say permission denied. systemctl start exited 0.

ExecStart=/tmp, which is a directory, made verify exit 1 and say Command /tmp is not executable: Is a directory. The journal said status=203/EXEC and did not say Is a directory. systemctl start exited 0.

What the local check flags

The browser paste flags a bare ExecStart and a path that is not absolute. It cannot see this machine. The local script can. Run it on the host that will start the unit. A missing path on a laptop is not a missing path on the server.

It flags a bare name (systemd-execstart-bare), a relative ExecStart, a missing absolute path, a directory used as ExecStart, a file the service account cannot execute, a missing User= (systemd-user-missing), a missing Group= (systemd-group-missing), and a WorkingDirectory= that is relative, missing, not a directory, or not searchable by that account. It does not flag User= or Group= when DynamicUser=yes. It does not flag a WorkingDirectory= that starts with -. It does not create the account. It does not print the file.

After a start, read Result and ExecMainStatus. A zero exit from systemctl start on a Type=simple unit was 216, 217, 200, and 203 in the runs above.

Once the account and the path are real, the remote-control unit is the Agent Ops Kit ($19). The file does not create a group that is not in the group database. The same unit is on the kit page. The remote-control note is where that unit is written out.

Need a VPS to try this on? Everything here was tested on a DigitalOcean Ubuntu 24.04 droplet: get one on DigitalOcean. The DigitalOcean link pays the site owner account credit, not cash. Any other affiliate link may pay a commission. Your price is the same. Disclosure.