Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lgpo.set state not finding the policy "Remove access to use all Windows Update features" #50079

Closed
apcookrz opened this issue Oct 16, 2018 · 5 comments

Comments

Projects
None yet
3 participants
@apcookrz
Copy link

commented Oct 16, 2018

Description of Issue/Question

When using the lgpo.set state to try and configure this group policy I get a return of Unable to find Machine Policy Remove access to use all Windows Update features

Setup

store-lgpo:
  lgpo.set:
    - computer_policy:
        Configure Automatic Updates: Disabled
        Remove access to use all Windows update features: Enabled

Steps to Reproduce Issue

Using the above setup in a state and then running a state.apply for the state on a Windows Minions

Versions Report

Salt Version:
Salt: 2018.3.2

Dependency Versions:
cffi: Not Installed
cherrypy: Not Installed
dateutil: Not Installed
docker-py: 1.10.6
gitdb: 2.0.4
gitpython: 2.1.11
ioflo: Not Installed
Jinja2: 2.7.2
libgit2: Not Installed
libnacl: Not Installed
M2Crypto: Not Installed
Mako: Not Installed
msgpack-pure: Not Installed
msgpack-python: 0.5.6
mysql-python: Not Installed
pycparser: Not Installed
pycrypto: 2.6.1
pycryptodome: Not Installed
pygit2: Not Installed
Python: 2.7.5 (default, Jul 13 2018, 13:06:57)
python-gnupg: Not Installed
PyYAML: 3.11
PyZMQ: 15.3.0
RAET: Not Installed
smmap: 2.0.4
timelib: Not Installed
Tornado: 4.2.1
ZMQ: 4.1.4

System Versions:
dist: centos 7.5.1804 Core
locale: UTF-8
machine: x86_64
release: 3.10.0-862.11.6.el7.x86_64
system: Linux
version: CentOS Linux 7.5.1804 Core

@apcookrz apcookrz changed the title lgpo.set state not finding the policy lgpo.set state not finding the policy "Remove access to use all Windows Update features" Oct 16, 2018

@garethgreenaway garethgreenaway added this to the Blocked milestone Oct 16, 2018

@garethgreenaway

This comment has been minimized.

Copy link
Member

commented Oct 16, 2018

@dwoz @twangboy Thoughts?

@twangboy

This comment has been minimized.

Copy link
Contributor

commented Oct 16, 2018

@bc-alex LGPO is case sensitive. You need to capitalize the U in Windows Update...

        Remove access to use all Windows Update features: Enabled
@apcookrz

This comment has been minimized.

Copy link
Author

commented Oct 16, 2018

@twangboy
Remove access to use all Windows Update features: Enabled

I have changed the U to be uppercase. And am now getting a slightly different return:
Comment: Unable to find a policy with the name "Remove access to use all Windows Update features".

@apcookrz

This comment has been minimized.

Copy link
Author

commented Oct 16, 2018

@twangboy I solved this. For some reason, for that particular policy I had to define the full path to it:
Windows Components\Windows Update\Remove access to use all Windows Update features: Enabled

@twangboy

This comment has been minimized.

Copy link
Contributor

commented Oct 16, 2018

OK, so it looks like it's not finding the policy with that Name. So I set the value in gpedit and then ran lgpo.get machine . This returned something that looked like this:

Windows Components\Windows Update\Remove access to use all Windows Update features

So, then I did lgpo.get_policy_info "Windows Components\Windows Update\Remove access to use all Windows Update features" machine and I got the following:

local:
    ----------
    message:
    policy_aliases:
        - Remove access to use all Windows Update features
        - DisableUXWUAccess
        - Windows Components\Windows Update\Remove access to use all Windows Update features
    policy_class:
        machine
    policy_elements:
    policy_found:
        True
    policy_name:
        Windows Components\Windows Update\Remove access to use all Windows Update features
    rights_assignment:
        False

So, from what this is returning, you should be able to use anything under policy_aliases to set/get policy, but the one we're using isn't working. So, you can try one of the other two. I was able to get policy info using DisableUXWUAcess and Windows Components\Windows Update\Remove access to use all Windows Update features, so either of those should work to set it.

@twangboy twangboy closed this Oct 16, 2018

lomeroe added a commit to lomeroe/salt that referenced this issue Oct 18, 2018

add fix/test for saltstack#50079
ADML display names that have a single match in each Computer/User policy
would not work with the "short" display name, requiring either the
"long" name or the explicit policy name

lomeroe added a commit to lomeroe/salt that referenced this issue Oct 24, 2018

add fix/test for saltstack#50079
ADML display names that have a single match in each Computer/User policy
would not work with the "short" display name, requiring either the
"long" name or the explicit policy name

lomeroe added a commit to lomeroe/salt that referenced this issue Nov 2, 2018

add fix/test for saltstack#50079
ADML display names that have a single match in each Computer/User policy
would not work with the "short" display name, requiring either the
"long" name or the explicit policy name

gitebra pushed a commit to gitebra/salt that referenced this issue Nov 14, 2018

Merge remote-tracking branch 'upstream/develop' into develop
* upstream/develop: (39 commits)
  Add documentation for ssh_host configuration under Saltify
  parted: support variable length output for print
  Reduce the number of days an issue is stale by 10
  Remove flaky test
  Adds timeouts to the manage.down runner
  Fix test_matcher on Windows
  Updating the swap function in the mount.swap function also check the device name when checking the fstab data.  Updating tests to reflect new behavior.
  update to use a single line if statement when dealing with prepended text
  add runTest method to class for PY2
  add a test for saltstack#47784
  change backslashes in comment string to fix lint error
  add fix/test for saltstack#50079
  more lint fixes
  lint fixes in test
  update test to actually work
  add missing comma in function call
  Log a warning message instead of an exception when a SID cannot be converted to a username (for user rights assignments)
  capture and print exception information
  update method for creating size field of **delvals items for py3 compatibility
  fix clobbering of admx_search_results which was keeping some policies from being properly detected
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.