Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9479 "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions. Change By: Mihai Buzgau Sprint: PR - 2019-03-06 , PR - 2019-03-20 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title Gheorghe Popescu commented on PUP-9479 Re: "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions. Paul H Cannot reproduce the issues We tried to reproduce this issue(on puppet 4.9.4) with Domain Controller(default configuration) and above steps but have failed to encounter the error. Steps: install puppet 4.9.4 setup the Domain Controller(default config) apply the first manifest from ` Code before issue appeared` - success apply the second manifest from `Code after issue appeared` - success Can you share more details? Or highlight if there are any issues in our approach? Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title Gheorghe Popescu assigned an issue to Gheorghe Popescu Puppet / PUP-9479 "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions. Change By: Gheorghe Popescu Assignee: Gheorghe Popescu Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title Gheorghe Popescu assigned an issue to Unassigned Puppet / PUP-9479 "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions. Change By: Gheorghe Popescu Assignee: Gheorghe Popescu Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title Gheorghe Popescu assigned an issue to Gheorghe Popescu Puppet / PUP-9479 "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions. Change By: Gheorghe Popescu Assignee: Gheorghe Popescu Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9479 "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions. Change By: Mihai Buzgau Sprint: PR - Triage 2019-03-06 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9479 "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions. Change By: Mihai Buzgau Story Points: 3 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title Geoff Nichols updated an issue Puppet / PUP-9479 "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions. Change By: Geoff Nichols Team: Platform OS Puppet Romania Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title Geoff Nichols updated an issue Puppet / PUP-9479 "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions. Change By: Geoff Nichols Labels: needs_repro permissions type_and_provider windows Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title Geoff Nichols updated an issue Puppet / PUP-9479 "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions. Change By: Geoff Nichols Sprint: PR - Triage Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title
Paul H updated an issue
Puppet / PUP-9479
"Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Change By:
Paul H
Pertinent information: -I've personally confirmed that this affects the following OS versions: Windows Server 2008 SP1 Windows Server 2008 SP2 Windows Windows Server 2008 R2 SP1 Windows Server 2012 Windows Server 2012 R2-Puppet version: 4.9.4 -Scope: This behavior has affected hundred of windows hosts throughout our environment. -Summary: After pushing an update to change the group of a powershell script from "Administrator" to "Administrators", a large number of managed hosts started to fail with "Failed to initialize ACL: The parameter is incorrect." errors. I'm speculating that this might be related to an sid conflict, as all of our hosts are joined to a domain and there is an administrators group with an sid that matches what appears for local groups. Code before issue appeared: {code:java}file { 'c:/os_config/scripts/configureWinRM.ps1': ensure => 'file', owner => 'Administrator', group => 'Administrator', content => template('fakepathforexample/configureWinRM.erb'), } {code}Code after issue appeared: {code:java}file { 'c:/os_config/scripts/configureWinRM.ps1': ensure => 'file', owner => 'Administrator', group => ' Administrator Administrators ', content => template('fakepathforexample/configureWinRM.erb'), }{code} SID comparison: {code:java}PS C:\Users\phansen_alt> Get-ADGroup -Identity Administrators DistinguishedName : CN=Administrators,CN=Builtin,DC=REDACTED,DC=comGroupCategory : SecurityGroupScope: DomainLocalName : AdministratorsObjectClass : groupObjectGUID: d2afeac8-ee3f-4bae-8458-27f4a05e6e85SamAccountName: AdministratorsSID : S-1-5-32-544PS C:\Users\phansen_alt> (Get-Localgroup -Name Administrators).sidBinaryLength AccountDomainSid Value - 16 S-1-5-32-544{code}Error message: {code:java}Error: Failed to set owner to 'S-1-5-21-3450263623-690944591-812587964-500': Failed to initialize ACL: The parameter is incorrect. Error: /Stage[main]/REDACTED::Winrm/File[c:/os_config/scripts/configureWinRM.ps1]/owner: change from BUILTIN\Administrators to \Administrator failed: Failed to set owner to 'S-1-5-21-3450263623-690944591-812587964-500': Failed to initialize ACL: The parameter is incorrect. Error: Failed to set group to 'S-1-5-32-544': Failed to initialize ACL: The parameter is incorrect. Error: /Stage[main]/REDACTED::Winrm/File[c:/os_config/scripts/configureWinRM.ps1]/group: change from NT AUTHORITY\SYSTEM to BUILTIN\Administrators failed: Failed to set group to 'S-1-5-32-544': Failed to initialize ACL: The parameter is incorrect.{code} Things to note: -Initial deployments of this file work without issue, the error only appears when the permissions are being changed -Modifying the permissions with powershell or the gui works without issue -I've developed a powershell exec workaround for
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title Paul H commented on PUP-9479 Re: "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions. Please see the attached file (puppetrun.txt) for a puppet run with debug on. Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title
Paul H updated an issue
Puppet / PUP-9479
"Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Change By:
Paul H
Pertinent information: -I've personally confirmed that this affects the following OS versions: Windows Server 2008 SP1 Windows Server 2008 SP2 Windows Windows Server 2008 R2 SP1 Windows Server 2012 Windows Server 2012 R2-Puppet version: 4.9.4 -Scope: This behavior has affected hundred of windows hosts throughout our environment. -Summary: After pushing an update to change the group of a powershell script from "Administrator" to "Administrators", a large number of managed hosts started to fail with "Failed to initialize ACL: The parameter is incorrect." errors. I'm speculating that this might be related to an sid conflict, as all of our hosts are joined to a domain and there is an administrators group with an sid that matches what appears for local groups. Code before issue appeared: {code:java}file { 'c:/os_config/scripts/configureWinRM.ps1': ensure => 'file', owner => 'Administrator', group => 'Administrator', content => template('fakepathforexample/configureWinRM.erb'), } {code}Code after issue appeared: {code:java}file { 'c:/os_config/scripts/configureWinRM.ps1': ensure => 'file', owner => 'Administrator', group => 'Administrator', content => template('fakepathforexample/configureWinRM.erb'), }{code} SID comparison: {code:java}PS C:\Users\phansen_alt> Get-ADGroup -Identity Administrators DistinguishedName : CN=Administrators,CN=Builtin,DC=REDACTED,DC=comGroupCategory : SecurityGroupScope: DomainLocalName : AdministratorsObjectClass : groupObjectGUID: d2afeac8-ee3f-4bae-8458-27f4a05e6e85SamAccountName: AdministratorsSID : S-1-5-32-544PS C:\Users\phansen_alt> (Get-Localgroup -Name Administrators).sidBinaryLength AccountDomainSid Value - 16 S-1-5-32-544{code}Error message: {code:java}Error: Failed to set owner to 'S-1-5-21-3450263623-690944591-812587964-500': Failed to initialize ACL: The parameter is incorrect. Error: /Stage[main]/REDACTED::Winrm/File[c:/os_config/scripts/configureWinRM.ps1]/owner: change from BUILTIN\Administrators to \Administrator failed: Failed to set owner to 'S-1-5-21-3450263623-690944591-812587964-500': Failed to initialize ACL: The parameter is incorrect. Error: Failed to set group to 'S-1-5-32-544': Failed to initialize ACL: The parameter is incorrect. Error: /Stage[main]/REDACTED::Winrm/File[c:/os_config/scripts/configureWinRM.ps1]/group: change from NT AUTHORITY\SYSTEM to BUILTIN\Administrators failed: Failed to set group to 'S-1-5-32-544': Failed to initialize ACL: The parameter is incorrect.{code} Things to note: -Initial deployments of this file work without issue, the error only appears when the permissions are being changed -Modifying the permissions with powershell or the gui works without issue -I've developed a powershell exec workaround for this, and
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title Paul H updated an issue Puppet / PUP-9479 "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions. Change By: Paul H Attachment: puppetrun.txt Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title
Paul H updated an issue
Puppet / PUP-9479
"Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Change By:
Paul H
Pertinent information: -I've personally confirmed that this affects the following OS versions: Windows Server 2008 SP1Windows Server 2008 SP2Windows Windows Server 2008 R2 SP1Windows Server 2012Windows Server 2012 R2-Puppet version:4.9.4-Scope:This behavior has affected hundred of windows hosts throughout our environment. -Summary: After pushing an update to change the group of a powershell script from "Administrator" to "Administrators", a large number of managed hosts started to fail with "Failed to initialize ACL: The parameter is incorrect." errors. I'm speculating that this might be related to an sid conflict, as all of our hosts are joined to a domain and there is an administrators group with an sid that matches what appears for local groups. Code before issue appeared: {code:java} file { 'c:/os_config/scripts/configureWinRM.ps1': ensure => 'file', owner => 'Administrator', group => 'Administrator', content => template('fakepathforexample/configureWinRM.erb'), } {code}Code after issue appeared: {code:java} file { 'c:/os_config/scripts/configureWinRM.ps1': ensure => 'file', owner => 'Administrator', group => 'Administrator', content => template('fakepathforexample/configureWinRM.erb'), }{code} SID comparison: {code:java} PS C:\Users\phansen_alt> Get-ADGroup -Identity Administrators DistinguishedName : CN=Administrators,CN=Builtin,DC=REDACTED,DC=comGroupCategory : SecurityGroupScope: DomainLocalName : AdministratorsObjectClass : groupObjectGUID: d2afeac8-ee3f-4bae-8458-27f4a05e6e85SamAccountName: AdministratorsSID : S-1-5-32-544PS C:\Users\phansen_alt> (Get-Localgroup -Name Administrators).sidBinaryLength AccountDomainSid Value - 16 S-1-5-32-544{code}Error message: {code:java} Error: Failed to set owner to 'S-1-5-21-3450263623-690944591-812587964-500': Failed to initialize ACL: The parameter is incorrect. Error: /Stage[main]/REDACTED::Winrm/File[c:/os_config/scripts/configureWinRM.ps1]/owner: change from BUILTIN\Administrators to \Administrator failed: Failed to set owner to 'S-1-5-21-3450263623-690944591-812587964-500': Failed to initialize ACL: The parameter is incorrect. Error: Failed to set group to 'S-1-5-32-544': Failed to initialize ACL: The parameter is incorrect. Error: /Stage[main]/REDACTED::Winrm/File[c:/os_config/scripts/configureWinRM.ps1]/group: change from NT AUTHORITY\SYSTEM to BUILTIN\Administrators failed: Failed to set group to 'S-1-5-32-544': Failed to initialize ACL: The parameter is incorrect.{code} Things to note:-Initial deployments of this file work without issue, the error only appears when the permissions are being changed-Modifying the permissions with powershell or the gui works without issue-I've developed a powershell exec workaround for this,
Jira (PUP-9479) "Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Title: Message Title
Paul H created an issue
Puppet / PUP-9479
"Failed to initialize ACL: The parameter is incorrect" errors when changing windows permissions.
Issue Type:
Bug
Assignee:
Unassigned
Created:
2019/02/06 12:49 PM
Priority:
Normal
Reporter:
Paul H
Pertinent information: -I've personally confirmed that this affects the following OS versions: Windows Server 2008 SP1 Windows Server 2008 SP2 Windows Windows Server 2008 R2 SP1 Windows Server 2012 Windows Server 2012 R2 -Puppet version: 4.9.4 -Scope: This behavior has affected hundred of windows hosts throughout our environment. -Summary: After pushing an update to change the group of a powershell script from "Administrator" to "Administrators", a large number of managed hosts started to fail with "Failed to initialize ACL: The parameter is incorrect." errors. I'm speculating that this might be related to an sid conflict, as all of our hosts are joined to a domain and there is an administrators group with an sid that matches what appears for local groups. Code before issue appeared:
file { 'c:/os_config/scripts/configureWinRM.ps1':
ensure => 'file',
owner => 'Administrator',
group => 'Administrator',
