Fix lgpo.set state idempotency when element ids are used (#68489)#69370
Merged
Conversation
The state's policy comparison treated a requested dict keyed by ADMX element id and a current dict keyed by the ADML display name as different, even though lgpo.set accepts both forms as aliases. The result: on the first run the state set the policy and reported success, but on every subsequent run it called lgpo.set again, saw an empty post-set diff, and returned "Failed to set the following policies". Normalize both sides of the comparison to the canonical element id via policy_lookup[name]["policy_elements"] before _compare_policies runs so runs are idempotent regardless of which alias the user wrote. Fixes saltstack#68489
twangboy
approved these changes
Jun 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Makes the
lgpo.setstate idempotent when the requested policy uses ADMXelement ids for sub-element keys. Previously the state succeeded on the first
run and then reported "Failed to set the following policies" on every
subsequent run for any policy with sub-elements.
What issues does this PR fix or reference?
Fixes #68489
Previous Behavior
The state compared a requested dict keyed by ADMX element id with a current
dict (read back via
lgpo.get_policy) keyed by the ADML display name. Thetwo keys differ, so the comparison declared a change.
lgpo.setreturnedTrue (no work to do), the post-set diff was empty, and the state returned
result=False, comment="Failed to set the following policies: …".New Behavior
The comparison normalizes both the requested and current sub-element dicts
to the canonical ADMX
element_id(using thepolicy_elementsmetadata already retrieved via
lgpo.get_policy_info) before_compare_policiesruns. Both alias forms now compare equal, so repeatedstate runs are idempotent.
Merge requirements satisfied?
changelog/68489.fixed.md)tests/pytests/unit/states/test_win_lgpo.py)Commits signed with GPG?
No