Windows directory management - weird permission error

[jmp242]

I'm trying to manage a directory:

unless $inventorusers == undef {
        $inventorusersArray = split($inventorusers, ',')

        inventor::userworkspace { $inventorusersArray: require => File['VaultWorkspace'], }

        inventor::designdata { $inventorusersArray: require => File['VaultWorkspace'], }

        inventor::templates { $inventorusersArray: require => File['VaultWorkspace'], }
      }

Where I use my own defines:

  define inventor::userworkspace {
    file { "VaultWorkspace-${title}":
      path    => "C:/VaultWorkspace/${title}",
      source  => "puppet:///modules/inventor/User",
      recurse => remote,
      owner   => $title,
      group   => 'Administrators',
      mode    => '0775',
      ensure  => present,
    }
  }
define inventor::templates {
    file { "Templates-${title}":
      path    => "C:/VaultWorkspace/${title}/Vault/Templates",
      source  => "puppet:///modules/inventor/Templates",
      recurse => true,
      owner   => 'SYSTEM',
      group   => 'Administrators',
      mode    => '0775',
      purge => true,
      ensure  => present,
    }
  }
  define inventor::designdata {
    file { "DesignData-${title}":
      path    => "C:/VaultWorkspace/${title}/Vault/Design Data",
      source  => "puppet:///modules/inventor/Design Data",
      recurse => true,
      owner   => 'SYSTEM',
      group   => 'Administrators',
      mode    => '0775',
      purge => true,
      ensure  => present,
    }
  }

Each is in its own .pp file in the manifests directory. The $inventorusers fact is an external fact on the computer. It has a Windows domain username CSV list in it. This generally seems to work, but I'm getting on at least one computer an error:

Failed to generate additional resources using 'eval_generate':
Permission denied @ dir_initialize - C:/VaultWorkspace/tio1/Vault/Design
 Data/_V

This seems odd as puppet is managing the directory and setting permissions . . . It started after we added the second defines, so but puppet runs as SYSTEM or a member of the Administrators group if done by hand - so shouldn't puppet have permissions? This is on Windows 7 x64 SP1, puppet agent 1.8.1 for now.