diff --git a/REFERENCE.md b/REFERENCE.md
index ed352ed..3ea0261 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -88,6 +88,7 @@ The following parameters are available in the `cron` class:
 * [`crontab_run_parts`](#-cron--crontab_run_parts)
 * [`file_mode`](#-cron--file_mode)
 * [`dir_mode`](#-cron--dir_mode)
+* [`cron_users_deny_ensure`](#-cron--cron_users_deny_ensure)
 * [`package_ensure`](#-cron--package_ensure)
 
 ##### <a name="-cron--service_name"></a>`service_name`
@@ -246,6 +247,14 @@ The file mode for the cron directories
 
 Default value: `'0755'`
 
+##### <a name="-cron--cron_users_deny_ensure"></a>`cron_users_deny_ensure`
+
+Data type: `Enum['file', 'absent']`
+
+The state of the cron.deny file when $manage_users_deny is true.
+
+Default value: `'file'`
+
 ##### <a name="-cron--package_ensure"></a>`package_ensure`
 
 Data type: `Cron::Package_ensure`
diff --git a/manifests/init.pp b/manifests/init.pp
index dd6403e..8c4859c 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -19,6 +19,7 @@
 # @param crontab_run_parts Define sadditional cron::run_parts resources
 # @param file_mode The file mode for the system crontab file
 # @param dir_mode The file mode for the cron directories
+# @param cron_users_deny_ensure The state of the cron.deny file when $manage_users_deny is true.
 #
 # @example simply include the module
 #  include cron
@@ -49,6 +50,7 @@
   Cron::Run_parts      $crontab_run_parts       = {},
   Stdlib::Filemode     $file_mode       = '0644',
   Stdlib::Filemode     $dir_mode        = '0755',
+  Enum['file', 'absent'] $cron_users_deny_ensure = 'file',
 ) {
   contain 'cron::install'
   contain 'cron::service'
@@ -68,7 +70,7 @@
 
   if $manage_users_deny {
     file { '/etc/cron.deny':
-      ensure  => file,
+      ensure  => $cron_users_deny_ensure,
       mode    => $allow_deny_mode,
       owner   => 'root',
       group   => 0,