ayohrling / local_security_policy

Apache License 2.0
6 stars 28 forks source link

Having a Message of the Day stops the provider "policy" from being fetched #105

Open 1WindowsPuppetAdmin opened 4 years ago

1WindowsPuppetAdmin commented 4 years ago

I have a message of the day (using puppetlabs-MOTD module) which sets a setting in HKLM:\Software\Microsoft\Windows\CurrentVersion\policies\system\legalnoticetext

The text is pretty standard like

************
If you are not authorized for login please log off now
You are subject to having your activities monitored
***********

or something to that effect (with \n characters for the new lines).

I get an error that says:

Could not prefetch local_security_policy provider 'policy': Could not parse line: <It gives me the text without the '*' characters at all>

It does work if I blank that out but Security would rather we have that message in place.

This is for Windows 2012 R2, puppet agent 6.16.0

Andy-Adrian commented 1 year ago

Change the newline to \r\n in the MOTD data. Windows requires the carriage return character as well for secedit to parse the string correctly during export. Just using the \n causes secedit to render the newlines into the INI file it exports, which this module tries to parse for system config. And since the string by itself on a new line is not valid for the INI, the parse error is thrown.

Alternatively, you can use this module to manage the login text using

local_security_policy { 'Interactive logon: Message text for users attempting to log on': 
  ensure => present,
  policy_value => "************,If you are not authorized for login please log off now,You are subject to having your activities monitored,***********",
}

local_security_poilcy { 'Interactive logon: Message title for users attempting to log on':
  ensure => present,
  policy_value => "Login notice",
}

Interactive logon: Message text for users attempting to log on is an array for secedit (not a simple string; it will do the conversion into the registry key automagically) so you'll need to replace the newlines with commas in the legalnoticetext data.