Cannot apply state that contains lgpo.set

[DaveOHenry]

Description of Issue/Question

I was really looking forward to using the new gpo state, but unfortunately it is not working for me. I looked up the names / values of the policies in gpedit.msc and tried to follow the example configuration from https://docs.saltstack.com/en/latest/ref/states/all/salt.states.win_lgpo.html . The documentation looks pretty straightforward, but maybe I missed something or there is some kind of syntax error in my config?

Setup

/srv/salt/windows/init.sls

group_policy:
  lgpo.set:
    - computer_policy:
        "Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for disconnected sessions":
            "End a disconnected session": 15 minutes
        "Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for active but idle Remote Desktop Services sessions":
            "Idle session limit": 15 minutes
        "Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for logoff of RemoteApp sessions":
            "RemoteApp session logoff delay": 15 minutes

Steps to Reproduce Issue

execute:

salt 'win_server' state.apply windows

error:

win_server:
    Data failed to compile:
----------
    Rendering SLS 'base:windows' failed: found unknown escape character 'R'; line 4

---
group_policy:
  lgpo.set:
    - computer_policy:
        "Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for disconnected sessions":    <======================
            "End a disconnected session": 15 minutes
        "Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for active but idle Remote Desktop Services sessions":
            "Idle session limit": 15 minutes
        "Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for logoff of RemoteApp sessions":
            "RemoteApp session logoff delay": 15 minutes
---

Versions Report

Salt Version:
           Salt: 2016.11.1

Dependency Versions:
           cffi: Not Installed
       cherrypy: Not Installed
       dateutil: 2.5.1
          gitdb: 0.5.4
      gitpython: 0.3.2 RC1
          ioflo: Not Installed
         Jinja2: 2.7.2
        libgit2: Not Installed
        libnacl: Not Installed
       M2Crypto: Not Installed
           Mako: 0.9.1
   msgpack-pure: Not Installed
 msgpack-python: 0.4.6
   mysql-python: 1.2.3
      pycparser: Not Installed
       pycrypto: 2.6.1
         pygit2: Not Installed
         Python: 2.7.6 (default, Oct 26 2016, 20:30:19)
   python-gnupg: Not Installed
         PyYAML: 3.10
          PyZMQ: 14.4.0
           RAET: Not Installed
          smmap: 0.8.2
        timelib: Not Installed
        Tornado: 4.2.1
            ZMQ: 4.0.5

System Versions:
           dist: Ubuntu 14.04 trusty
        machine: x86_64
        release: 3.19.0-73-generic
         system: Linux
        version: Ubuntu 14.04 trusty

[lorengordon]

The error indicates an escape character was detected. As a workaround, try doubling the backslashes.

[DaveOHenry]

Thanks for the hint. So the documentation is at least misleading. I tried with double backslashes and the state runs now, but fails with an exception:

win_server:
----------
          ID: group_policy
    Function: lgpo.set
      Result: False
     Comment: An exception occurred in this state: Traceback (most recent call last):
                File "c:\salt\bin\lib\site-packages\salt\state.py", line 1744, in call
                  **cdata['kwargs'])
                File "c:\salt\bin\lib\site-packages\salt\loader.py", line 1702, in wrapper
                  return f(*args, **kwargs)
                File "c:\salt\bin\lib\site-packages\salt\states\win_lgpo.py", line 237, in set_
                  hierarchical_return=False)
                File "c:\salt\bin\lib\site-packages\salt\modules\win_lgpo.py", line 4016, in get
                  class_vals[policy_name] = _getScriptSettingsFromIniFile(_pol)
                File "c:\salt\bin\lib\site-packages\salt\modules\win_lgpo.py", line 3630, in _getScriptSettingsFromIniFile
                  _existingData = _existingData.split('\r\n')
              AttributeError: 'NoneType' object has no attribute 'split'
     Started: 11:30:39.840000
    Duration: 2266.0 ms
     Changes:   

Summary for win_server
------------
Succeeded: 0
Failed:    1
------------
Total states run:     1
Total run time:   2.266 s

[lomeroe]

@DaveOHenry I think the error you are hitting was fixed by PR #37262. I don't think it has been back-ported into 2016.11 yet.

When I look a the documentation for the state, it shows using double backslashes, you are seeing different on your end?

[lomeroe]

@DaveOHenry I see what you mean on the docs now (I was looking at the code and not the rendered web pages).

[Ch3LL]

@DaveOHenry does the pr @lomeroe fix the Nontype error you are running into?

Either way I will mark this as a documentation bug as the double backslashes are in the code but not showing up in the web. Thanks

[lorengordon]

@Ch3LL that's how the double backslashes print when using sys.doc also. Might be a larger issue than appears. If I remember right, I needed to use \\ to print \, even in triple-single-quoted docstrings. To get a \\ to print as \\, I needed to explicitly specify raw strings. i.e. r'''

[DaveOHenry]

Thanks a lot for your feedback @Ch3LL @lomeroe . It is working for me with the win_lgpo.py file from PR https://github.com/saltstack/salt/pull/37262. Finally there is a simple way to automate the GPO stuff. I really appreciate your great work here.

[DaveOHenry]

Forgot to ask: Will the PR make it to 2016.11.x?

[lomeroe]

@DaveOHenry yeah, I'll try to get it (along with several other bug-fixes) backported in the next few days so it makes the next point release

[rallytime]

@DaveOHenry The PR is now in the 2016.11 branch and will be included in the 2016.11.3 release.