Open collinmcneese opened 2 years ago
Just had this issue called to my attention. I have a test setup and looking at what is actually responsible for trying to clear the privilege from the non-existent user.
This is being fixed by removing all user privileges prior to the user removal action. Target 18.6
Description
When attempting to use the
windows_user_privilege
,:set
and:clear
actions will fail with an exception if there is one or more unresolvable SID entries in the privilege which is being modified.Cause / Background
When operating in a multi-user environment, accounts which have been added to privileges are often removed as part of normal operations. When this happens, accounts which were assigned to a privilege remain attached to the privilege as an unresolvable SID entry.
The
windows_user_privilege
resource attempts to enumerate/translate the SID entry of every object as part of the remove action which is called during:set
and:clear
and when this is attempted against a SID which cannot be resolved the following exception is raised:Chef Version
16, 17
Platform Version
Windows Server 2012R2+
Replication Case
Replicating this case is fairly easy to do -- the following resources run in sequence in a recipe will replicate in an instance how this problem appears from other sources or causes in the wild:
If you example the current listing of members on the system after the above has been run, an unresolved SID will be present with the
SeNetworkLogonRight
privilegeIt is impossible to use the
windows_user_privilege
now for this resource until the unresolved SID has been removed from the privilege by some other meansClient Output
Stacktrace