Details
Normal Description
Attempts to have puppet create Windows users without passwords fail with result "OLE error code:800708C5 in Active Directory. The password does not meet the password policy requirements. Check the minimum password length, password complexity and password history requirements."
`This occurs regardless of password security policy. This only occurs when password security policy has been applied for complexity and/or minimum length.
Reproduction:
Create following users:
user {'bob':
|
ensure => present,
|
}
|
|
|
user {'bob_pwd':
|
ensure => present,
|
password => '@#SAFSawasf123',
|
}
|
|
|
user {'bob_managehome':
|
ensure => present,
|
managehome => true,
|
}
|
|
|
user {'bob_managehome_pwd':
|
ensure => present,
|
managehome => true,
|
password => '@#SAFSawasf123',
|
}
|
|
|
user {'bob_groups':
|
ensure => present,
|
groups => 'Users',
|
}
|
|
|
user {'bob_everything':
|
ensure => present,
|
managehome => true,
|
groups => 'Users',
|
}
|
|
|
user {'bob_everything_pwd':
|
ensure => present,
|
password => '@#SAFSawasf123',
|
managehome => true,
|
groups => 'Users',
|
}
|
Run puppet agent, then:
C:\Users\Administrator>puppet resource user
|
user { 'bob_everything_pwd':
|
ensure => 'present',
|
groups => ['Users'],
|
uid => 'S-1-5-21-1953236517-242735908-2433092285-1042',
|
}
|
user { 'bob_managehome_pwd':
|
ensure => 'present',
|
uid => 'S-1-5-21-1953236517-242735908-2433092285-1045',
|
}
|
user { 'bob_pwd':
|
ensure => 'present',
|
uid => 'S-1-5-21-1953236517-242735908-2433092285-1041',
|
}
|
Fixed by:
Editing puppet/lib/puppet/util/windows/adsi.rb to force verification that password is not nil. Any attempts to use managehome => true without specifying a password should validly fail. It is not possible to logon a user (to ensure the home directories are set) without a password that is set. This also cannot address when "Minimum password length" is greater than 0, as that is a validation built-in to Windows that requires a password for all new accounts.
