diff --git a/build.gradle b/build.gradle
index 86919e982..5f1ce155f 100644
--- a/build.gradle
+++ b/build.gradle
@@ -36,6 +36,8 @@ subprojects {
             'com.squareup.okio:okio:1.14.0',
             'org.bouncycastle:bcpkix-jdk15on:1.59',
             'org.bouncycastle:bcprov-jdk15on:1.59',
+            'org.codehaus.groovy:groovy:2.4.15',
+            'org.codehaus.groovy:groovy-json:2.4.15',
             'org.jetbrains.kotlin:kotlin-reflect:1.2.21',
             'org.jetbrains.kotlin:kotlin-stdlib:1.2.21',
     ]
diff --git a/client/build.gradle b/client/build.gradle
index 6b23adf4f..e7ba0ab9a 100644
--- a/client/build.gradle
+++ b/client/build.gradle
@@ -34,8 +34,8 @@ dependencies {
     compile 'de.gesellix:docker-engine:2018-02-17T22-09-45'
     compile 'de.gesellix:docker-compose:2018-02-17T22-19-12'
 
-    compile 'org.codehaus.groovy:groovy:2.4.13'
-    compile 'org.codehaus.groovy:groovy-json:2.4.13'
+    compile 'org.codehaus.groovy:groovy:2.4.15'
+    compile 'org.codehaus.groovy:groovy-json:2.4.15'
 
     compile 'org.slf4j:slf4j-api:1.7.25'
     testCompile 'ch.qos.logback:logback-classic:1.2.3'
diff --git a/client/src/main/groovy/de/gesellix/docker/client/stack/DeployConfigReader.groovy b/client/src/main/groovy/de/gesellix/docker/client/stack/DeployConfigReader.groovy
index abcf0eec2..fa10f7544 100644
--- a/client/src/main/groovy/de/gesellix/docker/client/stack/DeployConfigReader.groovy
+++ b/client/src/main/groovy/de/gesellix/docker/client/stack/DeployConfigReader.groovy
@@ -1,6 +1,7 @@
 package de.gesellix.docker.client.stack
 
 import de.gesellix.docker.client.DockerClient
+import de.gesellix.docker.client.LocalDocker
 import de.gesellix.docker.client.stack.types.ResolutionMode
 import de.gesellix.docker.client.stack.types.RestartPolicyCondition
 import de.gesellix.docker.client.stack.types.StackConfig
@@ -133,7 +134,7 @@ class DeployConfigReader {
                             stopSignal     : service.stopSignal,
                             tty            : service.tty,
                             openStdin      : service.stdinOpen,
-//                            secrets        : secrets,
+//                            secrets        : service.secrets,
                     ],
                     logDriver    : logDriver(service.logging),
                     resources    : serviceResources(service.deploy?.resources),
@@ -197,8 +198,10 @@ class DeployConfigReader {
             String namespace,
             String serviceName) {
 
+        def isWindows = LocalDocker.isNativeWindows()
+
         if (serviceNetworks == null || serviceNetworks.isEmpty()) {
-            serviceNetworks = ["default": null]
+            serviceNetworks = ["default": null as ServiceNetwork]
         }
 
         def serviceNetworkConfigs = []
@@ -212,7 +215,6 @@ class DeployConfigReader {
             if (serviceNetwork) {
                 aliases = serviceNetwork.aliases
             }
-            aliases << serviceName
 
             String namespacedName = "${namespace}_${networkName}" as String
 
@@ -224,6 +226,10 @@ class DeployConfigReader {
                 }
             }
 
+            if (isUserDefined(target, isWindows)) {
+                aliases << serviceName
+            }
+
             serviceNetworkConfigs << [
                     target : target,
                     aliases: aliases,
@@ -617,8 +623,23 @@ class DeployConfigReader {
         return [networkSpec, externalNetworkNames]
     }
 
+    boolean isContainerNetwork(String networkName) {
+        String[] elements = networkName?.split(':', 2)
+        return elements?.size() > 1 && elements[0] == "container"
+    }
+
+    boolean isUserDefined(String networkName, boolean isWindows) {
+        List<String> blacklist = isWindows ? ["default", "none", "nat"] : ["default", "bridge", "host", "none"]
+        return !(networkName in blacklist || isContainerNetwork(networkName))
+    }
+
     def validateExternalNetworks(List<String> externalNetworks) {
-        externalNetworks.each { name ->
+        boolean isWindows = LocalDocker.isNativeWindows()
+        externalNetworks.findAll { name ->
+            // Networks that are not user defined always exist on all nodes as
+            // local-scoped networks, so there's no need to inspect them.
+            isUserDefined(name, isWindows)
+        }.each { name ->
             def network
             try {
                 network = dockerClient.inspectNetwork(name)
@@ -627,6 +648,7 @@ class DeployConfigReader {
                 log.error("network ${name} is declared as external, but could not be inspected. You need to create the network before the stack is deployed (with overlay driver)")
                 throw new IllegalStateException("network ${name} is declared as external, but could not be inspected.", e)
             }
+
             if (network.content.Scope != "swarm") {
                 log.error("network ${name} is declared as external, but it is not in the right scope: '${network.content.Scope}' instead of 'swarm'")
                 throw new IllegalStateException("network ${name} is declared as external, but is not in 'swarm' scope.")