Jira (PUP-6586) User resource always reports password changed when account disabled

[Ethan Brown (JIRA)]

Title: Message Title

Ethan Brown commented on PUP-6586   Re: User resource always reports password changed when account disabled Due to the way that passwords are checked with the LogonUser API, an account has to be in an enabled state for Puppet to successfully login. Based on a successful login, it knows the current password is correct - but it currently only uses success as an indicator. So after a quick test, it looks like we have a pretty good option. ERROR_ACCOUNT_DISABLED - 1331 (from PUP-6569) is actually indicative of a successful password check, but failed logon due to disabled account. A quick test seems to indicate that is does indicate a good password. Given disabled account bob with password password: [2] pry(main)> Puppet::Util::Windows::User.logon_user('bob', 'password') Puppet::Util::Windows::Error: Failed to logon user "bob": Logon failure: account currently disabled. from C:/source/puppet/lib/puppet/util/windows/user.rb:70:in `block in logon_user'   [3] pry(main)> Puppet::Util::Windows::User.logon_user('bob', 'bobo') Puppet::Util::Windows::Error: Failed to logon user "bob": Logon failure: unknown user name or bad password. from C:/source/puppet/lib/puppet/util/windows/user.rb:70:in `block in logon_user' This would be the simplest fix for us. Other options for the sake of discussion if for some reason the above doesn't work out: Automatically enable the account, verify password like we do now, set back to disabled - I think we can agree this is a horrific idea Silently ignore the given password (and perhaps introduce a warning that passwords for disabled accounts are not managed), only setting the password when the account is actually enabled Require that passwords be not set / set to undef for disabled accounts Find a mechanism other than LogonUser to do the password validation (not sure one exists) Add Comment   This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.