Jira (PUP-10021) User resource always reports password changed when account disabled for Win 2012 R2

[Josh Cooper (JIRA)]

Josh Cooper commented on PUP-10021

Re: User resource always reports password changed when account disabled for Win 2012 R2 Moved to PUP project Add Comment

This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)

[Josh Cooper (JIRA)]

Josh Cooper moved an issue

Puppet / PUP-10021

User resource always reports password changed when account disabled for Win 2012 R2

Change By: Josh Cooper Component/s: Windows Component/s: Windows Key: PA PUP - 2901 10021 Project: Puppet Agent

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper updated an issue

Puppet / PUP-10021 User resource always reports password changed when account disabled for Win 2012 R2

Change By: Josh Cooper Team: Night's Watch

Add Comment

[Mihai Buzgau (JIRA)]

Mihai Buzgau updated an issue

Puppet / PUP-10021 User resource always reports password changed when account disabled for Win 2012 R2

Change By: Mihai Buzgau Story Points: 3

Add Comment

[Mihai Buzgau (JIRA)]

Mihai Buzgau updated an issue

Puppet / PUP-10021 User resource always reports password changed when account disabled for Win 2012 R2

Change By: Mihai Buzgau Sprint: PR NW - Triage 2019-10-16

Add Comment

[Dorin Pleava (JIRA)]

Dorin Pleava assigned an issue to Dorin Pleava

Puppet / PUP-10021 User resource always reports password changed when account disabled for Win 2012 R2

Change By: Dorin Pleava Assignee: Dorin Pleava

Add Comment

[Dorin Pleava (JIRA)]

Dorin Pleava commented on PUP-10021

Re: User resource always reports password changed when account disabled for Win 2012 R2 After some debugging, found the following: puppet does not change the password of a disabled account even though it reports so [disable check|https://github.com/puppetlabs/puppet/blob/master/lib/puppet/provider/user/windows_adsi.rb#L126]. the ending notice that reports a change in passwords is only shown when the password is wrong ([password check |https://github.com/puppetlabs/puppet/blob/master/lib/puppet/util/windows/user.rb#L72]), and this triggers the sync mechanism windows allows password changes of a disabled account, I think that this is also true for locked out/expired users I debugged and testing this on windows 2012r2. If windows supports password changes of disabled user, shouldn't puppet also change the password and display a notice/warning that the user is disabled? This way the command will become idempotent, and the ending notice will be true. Should I continue using this logic, or just try to remove the password change notice in case of a disabled user?

Add Comment

[Mihai Buzgau (JIRA)]

Mihai Buzgau updated an issue

Puppet / PUP-10021

User resource always reports password changed when account disabled for Win 2012 R2

Change By: Mihai Buzgau Sprint: NW - 2019-10-16 , NW - 2019-10-30

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper commented on PUP-10021

Re: User resource always reports password changed when account disabled for Win 2012 R2 Windows allows password changes of a disabled account, but puppet can only manage the password if it can login as the user, which it can't do when the account is disabled. See Ethan Brown's comment in https://tickets.puppetlabs.com/browse/PUP-6586?focusedCommentId=332667&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-332667. This functionality used to work. Please try to git bisect to see when it broke.

Add Comment

[Ciprian Badescu (JIRA)]

Ciprian Badescu updated an issue

Puppet / PUP-10021

User resource always reports password changed when account disabled for Win 2012 R2

Change By: Ciprian Badescu Fix Version/s: PUP 6.11.0

Add Comment

[Heston Hoffman (JIRA)]

Heston Hoffman updated an issue

Puppet / PUP-10021 User resource always reports password changed when account disabled for Win 2012 R2

Change By: Heston Hoffman Labels: resolved-issue-added

Add Comment

[Austin Boyd (JIRA)]

Austin Boyd updated an issue

Puppet / PUP-10021 User resource always reports password changed when account disabled for Win 2012 R2

Change By: Austin Boyd Zendesk Ticket IDs: 36181 Zendesk Ticket Count: 1

Add Comment

[Dorin Pleava (JIRA)]

Dorin Pleava updated an issue

Puppet / PUP-10021 User resource always reports password changed when account disabled for Win 2012 R2

Change By: Dorin Pleava Fix Version/s: PUP 6.12.0 Fix Version/s: PUP 6.4.5 Fix Version/s: PUP 5.5.18

Add Comment

[Kate Medred (JIRA)]

Kate Medred commented on PUP-10021

Re: User resource always reports password changed when account disabled for Win 2012 R2 Dorin Pleava are you able to clarify, does this fix allow.... A) Puppet will no longer allow password changes for inactive windows OR B) Puppet now changes the password for a non-active account on Windows I'm seeing both here. Thank so much!

Add Comment

[Dorin Pleava (JIRA)]

Dorin Pleava commented on PUP-10021

Re: User resource always reports password changed when account disabled for Win 2012 R2

Kate Medred Version B) is correct. Version A is how puppet worked before the fix. Now Puppet changes the password for a non-active account on Windows.

Add Comment

[Kate Medred (JIRA)]

Kate Medred commented on PUP-10021

Re: User resource always reports password changed when account disabled for Win 2012 R2

Dorin Pleava thanks for clarifying!

Add Comment