Windows permissions convergence on every run

[bm7150]

Description

Within our chef cookbooks on Windows, we need to include the synchronize permission on our directories, which is not currently an option for the windows file/directory resources. To get around this, we are using the bitmask to set those permissions to give us a bit more granular control over what permissions are set.

The problem is that we end up with those resources converging on every run of the chef client, keeping our cookbooks from being idempotent.

I've included below in the replication section a cookbook that can be spun up in the kitchen environment that replicates the issue we are seeing.

Chef Version

Chef Client: Exists in both 14.10.9-1 and 13.6.0, and i'm guessing anything in between

Platform Version

OS: Windows server 2016 (happens in Windows server 2012 and 2008r2 as well)
Chef Client: Tested in both 14.10.9-1 and 13.6.0

Replication Case

I've created a public cookbook that simulates what we are accomplishing that can be run in test-kitchen with the vagrant plugin.

Perms-Cookbook

Just download and run kitchen converge multiple times (was never able to get the multiple_converge option to work in my kitchen.yml, might be a local issue though). You can see during the directory task - change dacl appears each time.

Client Output

Link to gist with relevant output:

Client-Output