Uploaded image for project: 'Puppet'
  1. Puppet
  2. PUP-8231

Managing an existing Windows Group resource may error when any of its members is a virtual account (like IIS AppPool\DefaultAppPool or NT Service\Dhcp)

    XMLWordPrintable

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Fixed
    • PUP 4.10.10, PUP 5.3.4
    • PUP 4.10.11, PUP 5.3.6, PUP 5.5.0
    • None
    • Any version of Windows including 2008R2 and above (virtual accounts were introduced in 2008R2 / 7)

    • Hide
      • An existing group that contains virtual accounts should be modifiable with Puppet without error
      • Fix should not introduce any backwards incompatible changes to existing Windows Group behavior
      Show
      An existing group that contains virtual accounts should be modifiable with Puppet without error Fix should not introduce any backwards incompatible changes to existing Windows Group behavior
    • Windows
    • Windows Kanban
    • Customer Feedback
    • Normal
    • 3 - 25-50% of Customers
    • 3 - Serious
    • 5 - $$$$$$
    • Hide
      The group resource is not working as expected on windows.

      A potentially workaround might be to run an exec to add the user to the group after creation.. Not great but might work until it's resolved.
      Show
      The group resource is not working as expected on windows. A potentially workaround might be to run an exec to add the user to the group after creation.. Not great but might work until it's resolved.
    • Bug Fix
    • Hide
      While Puppet could create new Windows groups containing virtual accounts, it was previously unable to manage groups that contained at least one virtual account. Puppet may also have been unable to correctly manage groups with account names that appeared in both the local computer and in a domain, due to a failure to properly disambiguate the accounts. Both problems are now resolved.
      Show
      While Puppet could create new Windows groups containing virtual accounts, it was previously unable to manage groups that contained at least one virtual account. Puppet may also have been unable to correctly manage groups with account names that appeared in both the local computer and in a domain, due to a failure to properly disambiguate the accounts. Both problems are now resolved.
    • Needs Assessment

    Description

      Steps to reproduce

      1. Create Group "TestGroup" with "IIS AppPool\DefaultAppPool" as a member

      group { 'TestGroup':
          name            => 'TestGroup',
          ensure          => present,
          members         => ['IIS AppPool\DefaultAppPool'],
          auth_membership => false,
      }
      

      2. Re-run the same manifest

      group { 'TestGroup':
          name            => 'TestGroup',
          ensure          => present,
          members         => ['IIS AppPool\DefaultAppPool'],
          auth_membership => false,
      }
      

      3. Once the group exists on the system, Puppet fails to resolve the virtual account properly and generates an error like:

      "Could not resolve name: DefaultAppPool"

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              halim.wijaya Halim Wijaya
              Votes:
              1 Vote for this issue
              Watchers:
              9 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Zendesk Support