You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
(GH-1755) Add new DSC resource to manage SecurityPolicy - #1759
Adds the Microsoft.Windows/UserRightsAssignment resource. One instance per user right, keyed by the Windows constant (SeServiceLogonRight), with an identity list of accounts and a write-only setAction of replace (default), add or remove. Supports get, set, test, export, and --what-if.
Adds the windows_security_policy crate and manifests file that will also host the later AccountPolicy, SecurityOption and SecurityTemplate types.
Enables the Win32_Security_Authentication_Identity feature of the workspace windows dependency.
Adds reference docs, overview and changelog entries, package file entries, Pester tests and Rust unit tests.
Addresses the SecurityPolicyDsc part of Hardening with dsc 3 ? #1755, starting with its UserRightsAssignment resource.
PR Context
SecurityPolicyDsc manages user rights by exporting and re-importing secedit templates, so it depends on temp files, INF parsing and localized output. This resource calls the LSA account-rights APIs (LsaEnumerateAccountsWithUserRight, LsaAddAccountRights, LsaRemoveAccountRights) directly and compares accounts by SID, so Administrators, BUILTIN\Administrators and S-1-5-32-544 refer to the same holder. Holders are reported as DOMAIN\Name, or as the SID string when the account no longer exists.
Remarks on the design
SecurityPolicyDsc keyed an instance on the right plus Ensure and Force to express add, remove and exact-list semantics. Here identity is the complete list by default and setAction covers the other two cases, which matches how hardening baselines state these settings. An empty list with replace means No One.
The resource implements its own test. DSC's synthetic test compares arrays by exact string and skips write-only properties, so it can't judge add or remove or match an account written in a different form. The native test compares SID sets and reports _inDesiredState; DSC runs it before set because implementsPretest is false.
All operations require elevation, including get and export, because the LSA refuses to enumerate account rights from a non-elevated token.
Grants are applied before revokes so a logon right never has zero holders part-way through a replace. LsaRemoveAccountRights is always called for the single right, never with the flag that strips every right from an account.
right is documented as the instance key, but the schema never declares x-dsc-key: true. DSC identifies key properties through that keyword (docs/concepts/resources/properties.md:77–79), not through required, so schema consumers currently see no instance key. Add the key annotation to match the resource's per-right identity contract.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mikey Lombardi (He/Him) (michaeltlombardi)
left a comment
PR Summary
This change:
Microsoft.Windows/UserRightsAssignmentresource. One instance per user right, keyed by the Windows constant (SeServiceLogonRight), with anidentitylist of accounts and a write-onlysetActionofreplace(default),addorremove. Supportsget,set,test,export, and--what-if.windows_security_policycrate and manifests file that will also host the laterAccountPolicy,SecurityOptionandSecurityTemplatetypes.Win32_Security_Authentication_Identityfeature of the workspacewindowsdependency.UserRightsAssignmentresource.PR Context
SecurityPolicyDsc manages user rights by exporting and re-importing
secedittemplates, so it depends on temp files, INF parsing and localized output. This resource calls the LSA account-rights APIs (LsaEnumerateAccountsWithUserRight,LsaAddAccountRights,LsaRemoveAccountRights) directly and compares accounts by SID, soAdministrators,BUILTIN\AdministratorsandS-1-5-32-544refer to the same holder. Holders are reported asDOMAIN\Name, or as the SID string when the account no longer exists.Remarks on the design
EnsureandForceto express add, remove and exact-list semantics. Hereidentityis the complete list by default andsetActioncovers the other two cases, which matches how hardening baselines state these settings. An empty list withreplacemeans No One.test. DSC's synthetic test compares arrays by exact string and skips write-only properties, so it can't judgeaddorremoveor match an account written in a different form. The native test compares SID sets and reports_inDesiredState; DSC runs it beforesetbecauseimplementsPretestis false.getandexport, because the LSA refuses to enumerate account rights from a non-elevated token.LsaRemoveAccountRightsis always called for the single right, never with the flag that strips every right from an account.