search

dsccommunity / SecurityPolicyDsc

A wrapper around secedit.exe to configure local security policies
MIT License
177 stars 53 forks source link

Some or all identity references could not be translated #141

Closed thesutex closed 4 years ago

thesutex commented 4 years ago

when using IIS, creating apppools and deleting these creates SIDs that cant be translated, so the entire DSC part of "user rights assignment" fails when one SID (i.e. deleted default apppool) remains in the security policies like local policies\user rights assignment\Generate security audits

before deletion of apppool: image

after deletion of apppool (and after reboot): image

then DSC config (user rights assignment portion) fails due to :

Error Message: Exception calling "Translate" with "1" argument(s): "Some or all identity references could not be translated." Message ID: IdentityNotMappedException

image

the values that contains these SIDs in local policy \ user rights assignment is -Adjust memory quotas for a process -Generate security audits -Log on as a service -Replace a process level token

And these values I dont set in my DSC policy, but as said all my policies fails because these ones has invalid / orphaned SIDs.

is there a way go get DSC module to ignore SIDs it cant translate? if not how are one suppose to use this with IIS?

thesutex commented 4 years ago

latest version of module fixed this