False negative on UserRightsAssignment

[dsccommunity]

False negative on UserRightsAssignment

[BernieWhite]

Scesrv.log may not contain information, it is a generic message that is provided anytime the set fails. Is resource in the desired state?

[scottmckenzie]

I am experiencing the same problem. The resource is in the desired state it's just that DSC is reporting failure. Here is the relevant snippet of the DSC .details.json file:

  {"time": "2017-07-22T12:45:40.396+10:00", "type": "verbose", "message": "[azurevm]: LCM:  [ Start  Resource ]  [[UserRightsAssignment]AssignLogOnAsService]  "},
  {"time": "2017-07-22T12:45:40.396+10:00", "type": "verbose", "message": "[azurevm]: LCM:  [ Start  Test     ]  [[UserRightsAssignment]AssignLogOnAsService]  "},
  {"time": "2017-07-22T12:45:40.808+10:00", "type": "verbose", "message": "[azurevm]:                            [[UserRightsAssignment]AssignLogOnAsService] Testing contoso\\TestUser1 is present on policy Log_on_as_a_service"},
  {"time": "2017-07-22T12:45:40.809+10:00", "type": "verbose", "message": "[azurevm]:                            [[UserRightsAssignment]AssignLogOnAsService] Perform operation 'Query CimInstances' with following parameters, ''queryExpression' = SELECT * FROM Win32_UserAccount WHERE LocalAccount='True','queryDialect' = WQL,'namespaceName' = root\\cimv2'."},
  {"time": "2017-07-22T12:45:40.978+10:00", "type": "verbose", "message": "[azurevm]:                            [[UserRightsAssignment]AssignLogOnAsService] Operation 'Query CimInstances' complete."},
  {"time": "2017-07-22T12:45:40.979+10:00", "type": "verbose", "message": "[azurevm]:                            [[UserRightsAssignment]AssignLogOnAsService] TestUser1 do not have Privilege (Log_on_as_a_service)"},
  {"time": "2017-07-22T12:45:40.979+10:00", "type": "verbose", "message": "[azurevm]: LCM:  [ End    Test     ]  [[UserRightsAssignment]AssignLogOnAsService]  in 0.5840 seconds."},
  {"time": "2017-07-22T12:45:40.979+10:00", "type": "verbose", "message": "[azurevm]: LCM:  [ Start  Set      ]  [[UserRightsAssignment]AssignLogOnAsService]  "},
  {"time": "2017-07-22T12:45:41.382+10:00", "type": "verbose", "message": "[azurevm]:                            [[UserRightsAssignment]AssignLogOnAsService] Policy: Log_on_as_a_service. Identity: NT AUTHORITY\\NETWORK SERVICE contoso\\TestUser1 SQLServer2005SQLBrowserUser$makedisk0823AM0 NT SERVICE\\ALL SERVICES NT SERVICE\\SQLTELEMETRY NT SERVICE\\ReportServer NT SERVICE\\MSSQLFDLauncher NT SERVICE\\SQLSERVERAGENT NT SERVICE\\MSSQLSERVER IIS APPPOOL\\.NET v4.5 IIS APPPOOL\\.NET v4.5 Classic"},
  {"time": "2017-07-22T12:45:41.382+10:00", "type": "verbose", "message": "[azurevm]:                            [[UserRightsAssignment]AssignLogOnAsService] Granting Log_on_as_a_service rights to contoso\\TestUser1,NT AUTHORITY\\NETWORK SERVICE,SQLServer2005SQLBrowserUser$makedisk0823AM0,NT SERVICE\\ALL SERVICES,NT SERVICE\\SQLTELEMETRY,NT SERVICE\\ReportServer,NT SERVICE\\MSSQLFDLauncher,NT SERVICE\\SQLSERVERAGENT,NT SERVICE\\MSSQLSERVER,IIS APPPOOL\\.NET v4.5,IIS APPPOOL\\.NET v4.5 Classic"},
  {"time": "2017-07-22T12:45:41.414+10:00", "type": "verbose", "message": "[azurevm]:                            [[UserRightsAssignment]AssignLogOnAsService] Attempting to Set (contoso\\TestUser1,NT AUTHORITY\\NETWORK SERVICE,SQLServer2005SQLBrowserUser$makedisk0823AM0,NT SERVICE\\ALL SERVICES,NT SERVICE\\SQLTELEMETRY,NT SERVICE\\ReportServer,NT SERVICE\\MSSQLFDLauncher,NT SERVICE\\SQLSERVERAGENT,NT SERVICE\\MSSQLSERVER,IIS APPPOOL\\.NET v4.5,IIS APPPOOL\\.NET v4.5 Classic) for Policy Log_on_as_a_service)"},
  {"time": "2017-07-22T12:45:42.854+10:00", "type": "verbose", "message": "[azurevm]:                            [[UserRightsAssignment]AssignLogOnAsService] Testing contoso\\TestUser1 is present on policy Log_on_as_a_service"},
  {"time": "2017-07-22T12:45:42.855+10:00", "type": "verbose", "message": "[azurevm]:                            [[UserRightsAssignment]AssignLogOnAsService] Perform operation 'Query CimInstances' with following parameters, ''queryExpression' = SELECT * FROM Win32_UserAccount WHERE LocalAccount='True','queryDialect' = WQL,'namespaceName' = root\\cimv2'."},
  {"time": "2017-07-22T12:45:42.977+10:00", "type": "verbose", "message": "[azurevm]:                            [[UserRightsAssignment]AssignLogOnAsService] Operation 'Query CimInstances' complete."},
  {"time": "2017-07-22T12:45:42.978+10:00", "type": "verbose", "message": "[azurevm]:                            [[UserRightsAssignment]AssignLogOnAsService] TestUser1 do not have Privilege (Log_on_as_a_service)"},
  {"time": "2017-07-22T12:45:42.980+10:00", "type": "verbose", "message": "[azurevm]:                            [[UserRightsAssignment]AssignLogOnAsService] Task did not complete successfully"},
  {"time": "2017-07-22T12:45:43.001+10:00", "type": "verbose", "message": "[azurevm]: LCM:  [ End    Set      ]  [[UserRightsAssignment]AssignLogOnAsService]  in 2.0210 seconds."},

This is the config I am using:

UserRightsAssignment AssignLogOnAsService
{
    Policy   = 'Log_on_as_a_service'
    Identity = 'contoso\TestUser1'
}

[jcwalker]

@scottmckenzie what version of the module are you running?
Get-Module SecurityPolicyDsc -ListAvailable

[scottmckenzie]

1.4.0.0. The target resource is Windows Server 2016.

I'm using Azure DSC so this version was imported from the Modules Gallery in the Azure Portal.

[scottmckenzie]

Fixed by 9fc3a5b? Can we have a new release with this fix please?

[mcmcghee]

FYI I'm using the fix in #9fc3a5b and I'm seeing the issue. Using dev branch on Server 2016.
EDIT:
Disregard, I copied the dev branch and made a 1.4.0.1 version and redeployed. Errors are gone now. Nodes were still using old 1.4.0.0 code.