dsccommunity / SecurityPolicyDsc

A wrapper around secedit.exe to configure local security policies
MIT License
177 stars 53 forks source link

SecurityPolicyDsc: Maximum_lifetime_for_service_ticket cannot be set to "0" #175

Open hoppi1804 opened 2 years ago

hoppi1804 commented 2 years ago

Details of the scenario you tried and the problem that is occurring

Maximum_lifetime_for_service_ticket cannot be set to 0, even though MS documentation suggests this is possible https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket

Verbose logs showing the problem

PowerShell DSC resource MSFT_AccountPolicy failed to execute Set-TargetResource functionality with error message: Cannot validate argument on parameter 'Maximum_lifetime_for_service_ticket'. The 0 argument is less than the minimum allowed range of 10. Supply an argument that is greater than or equal to 10 and then try the command again.

Suggested solution to the issue

https://github.com/hoppi1804/SecurityPolicyDsc/commit/ab21db42e02501f188b080ee27098cd31b75da10 https://github.com/hoppi1804/SecurityPolicyDsc/commit/a409e4cbfcc26d2fe373936d2a3d17efd5f047c7

The DSC configuration that is used to reproduce the issue (as detailed as possible)

no repro

The operating system the target node is running

Version and build of PowerShell the target node is running

Version of the DSC module that was used

2.10.0.0