Skip to content

Commit a269116

Browse files
potatoqualiteeCopilot
potatoqualitee
and
Copilot
committed
Set-DbaPrivilege - Fix blank security policy entry updates (review of #10235)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 65c775f commit a269116

3 files changed

Lines changed: 74 additions & 9 deletions

File tree

‎docs/trackers/features/commit-bug-review-TRACKER.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ Find real bugs (logic errors, null refs, incorrect behavior) and fix them. Skip
7171
| 0ee03fc32 | New-DbaAgentJobStep - Fix OnFailAction ValidateSet order to match actual default (#10244) | DONE | Reviewed parameter metadata-only ValidateSet reorder; no bugs found. |
7272
| 63c906f9d | Set-DbaDbCompression - Add SortInTempDB parameter and fix views T-SQL bug (#10248) | DONE | Fixed indexed-view output/error metadata to use the view name instead of a stale table reference; added integration regression test. |
7373
| 4d1a9d80c | v2.7.27 | DONE | version bump - skip |
74-
| 232395207 | Set-DbaPrivilege, Get-DbaPrivilege - Add CreateGlobalObjects privilege support (#10235) | PENDING | |
74+
| 232395207 | Set-DbaPrivilege, Get-DbaPrivilege - Add CreateGlobalObjects privilege support (#10235) | DONE | Fixed empty privilege-entry updates so Set-DbaPrivilege still grants rights when secedit exports a blank line; added unit regression test. |
7575
| 099624061 | Get-DbaDbRestoreHistory - Add BackupStartDate, StopAt, and LastRestorePoint columns (#10249) | PENDING | |
7676
| 4f1e56ce4 | New-DbaDbMailAccount, Set-DbaDbMailAccount - Add Port, SSL, and authentication parameters (#10257) | PENDING | |
7777
| 8218d327e | Restore-DbaDatabase, Invoke-DbaAdvancedRestore - Add ErrorBrokerConversations parameter (#10253) | PENDING | |

‎public/Set-DbaPrivilege.ps1‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ function Convert-UserNameToSID ([string] `$Acc ) {
133133
<# DO NOT use Write-Message as this is inside of a script block #>
134134
Write-Verbose "Added $acc to Batch Logon Privileges on $env:ComputerName"
135135
} elseif ($BLline -notmatch $SID) {
136-
(Get-Content $tempfile) -replace "(SeBatchLogonRight = .+)", "`$1,*$SID" |
136+
(Get-Content $tempfile) -replace "SeBatchLogonRight = ", "SeBatchLogonRight = *$SID," |
137137
Set-Content $tempfile
138138
<# DO NOT use Write-Message as this is inside of a script block #>
139139
Write-Verbose "Added $acc to Batch Logon Privileges on $env:ComputerName"
@@ -156,7 +156,7 @@ function Convert-UserNameToSID ([string] `$Acc ) {
156156
<# DO NOT use Write-Message as this is inside of a script block #>
157157
Write-Verbose "Added $acc to Instant File Initialization Privileges on $env:ComputerName"
158158
} elseif ($IFIline -notmatch $SID) {
159-
(Get-Content $tempfile) -replace "(SeManageVolumePrivilege = .+)", "`$1,*$SID" |
159+
(Get-Content $tempfile) -replace "SeManageVolumePrivilege = ", "SeManageVolumePrivilege = *$SID," |
160160
Set-Content $tempfile
161161
<# DO NOT use Write-Message as this is inside of a script block #>
162162
Write-Verbose "Added $acc to Instant File Initialization Privileges on $env:ComputerName"
@@ -179,7 +179,7 @@ function Convert-UserNameToSID ([string] `$Acc ) {
179179
<# DO NOT use Write-Message as this is inside of a script block #>
180180
Write-Verbose "Added $acc to Lock Pages in Memory Privileges on $env:ComputerName"
181181
} elseif ($LPIMline -notmatch $SID) {
182-
(Get-Content $tempfile) -replace "(SeLockMemoryPrivilege = .+)", "`$1,*$SID" |
182+
(Get-Content $tempfile) -replace "SeLockMemoryPrivilege = ", "SeLockMemoryPrivilege = *$SID," |
183183
Set-Content $tempfile
184184
<# DO NOT use Write-Message as this is inside of a script block #>
185185
Write-Verbose "Added $acc to Lock Pages in Memory Privileges on $env:ComputerName"
@@ -202,7 +202,7 @@ function Convert-UserNameToSID ([string] `$Acc ) {
202202
<# DO NOT use Write-Message as this is inside of a script block #>
203203
Write-Verbose "Added $acc to Security Log Privileges on $env:ComputerName"
204204
} elseif ($SALine -notmatch $SID) {
205-
(Get-Content $tempfile) -replace "(SeAuditPrivilege = .+)", "`$1,*$SID" |
205+
(Get-Content $tempfile) -replace "SeAuditPrivilege = ", "SeAuditPrivilege = *$SID," |
206206
Set-Content $tempfile
207207
<# DO NOT use Write-Message as this is inside of a script block #>
208208
Write-Verbose "Added $acc to Write to Security Log Privileges on $env:ComputerName"
@@ -223,7 +223,7 @@ function Convert-UserNameToSID ([string] `$Acc ) {
223223
<# DO NOT use Write-Message as this is inside of a script block #>
224224
Write-Verbose "Added $acc to Service Logon Privileges on $env:ComputerName"
225225
} elseif ($SLline -notmatch $SID) {
226-
(Get-Content $tempfile) -replace "(SeServiceLogonRight = .+)", "`$1,*$SID" |
226+
(Get-Content $tempfile) -replace "SeServiceLogonRight = ", "SeServiceLogonRight = *$SID," |
227227
Set-Content $tempfile
228228
<# DO NOT use Write-Message as this is inside of a script block #>
229229
Write-Verbose "Added $acc to Service Logon Privileges on $env:ComputerName"
@@ -244,7 +244,7 @@ function Convert-UserNameToSID ([string] `$Acc ) {
244244
<# DO NOT use Write-Message as this is inside of a script block #>
245245
Write-Verbose "Added $acc to Create Global Objects Privileges on $env:ComputerName"
246246
} elseif ($CGOline -notmatch $SID) {
247-
(Get-Content $tempfile) -replace "(SeCreateGlobalPrivilege = .+)", "`$1,*$SID" |
247+
(Get-Content $tempfile) -replace "SeCreateGlobalPrivilege = ", "SeCreateGlobalPrivilege = *$SID," |
248248
Set-Content $tempfile
249249
<# DO NOT use Write-Message as this is inside of a script block #>
250250
Write-Verbose "Added $acc to Create Global Objects Privileges on $env:ComputerName"
@@ -270,4 +270,4 @@ function Convert-UserNameToSID ([string] `$Acc ) {
270270
}
271271
}
272272
}
273-
}
273+
}

‎tests/Set-DbaPrivilege.Tests.ps1‎

Lines changed: 66 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,73 @@ Describe $CommandName -Tag UnitTests {
2121
}
2222
}
2323
}
24+
25+
InModuleScope dbatools {
26+
Describe "Set-DbaPrivilege regressions" -Tag UnitTests {
27+
BeforeAll {
28+
function secedit {
29+
param(
30+
[Parameter(ValueFromRemainingArguments)]
31+
[object[]]$ArgumentList
32+
)
33+
}
34+
}
35+
36+
BeforeEach {
37+
$script:policyFile = Join-Path -Path ([System.IO.Path]::GetTempPath()) -ChildPath "secpolByDbatools.cfg"
38+
$script:capturedPolicyContent = $null
39+
40+
Mock Test-ElevationRequirement { $true }
41+
Mock Test-PSRemoting { $true }
42+
Mock Invoke-Command2 {
43+
param(
44+
$ComputerName,
45+
$Credential,
46+
$ScriptBlock,
47+
$ArgumentList
48+
)
49+
50+
if ($ScriptBlock.ToString() -match "secedit /export /cfg") {
51+
Set-Content -Path $script:policyFile -Value @(
52+
"[Privilege Rights]"
53+
"SeCreateGlobalPrivilege = "
54+
)
55+
return
56+
}
57+
58+
if ($ArgumentList.Count -gt 0) {
59+
& $ScriptBlock @ArgumentList
60+
$script:capturedPolicyContent = Get-Content -Path $script:policyFile
61+
return
62+
}
63+
64+
Remove-Item -Path $script:policyFile -Force -ErrorAction SilentlyContinue
65+
}
66+
}
67+
68+
AfterEach {
69+
Remove-Item -Path $script:policyFile -Force -ErrorAction SilentlyContinue
70+
}
71+
72+
It "adds CreateGlobalObjects when the privilege entry exists but is empty" {
73+
$user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
74+
$expectedSid = ([System.Security.Principal.NTAccount]$user).Translate([System.Security.Principal.SecurityIdentifier]).Value
75+
76+
$splatSetPrivilege = @{
77+
ComputerName = $env:COMPUTERNAME
78+
Type = "CreateGlobalObjects"
79+
User = $user
80+
Confirm = $false
81+
}
82+
$null = Set-DbaPrivilege @splatSetPrivilege
83+
84+
($script:capturedPolicyContent | Where-Object { $PSItem -match "^SeCreateGlobalPrivilege" }) |
85+
Should -Match "^SeCreateGlobalPrivilege = \*$([regex]::Escape($expectedSid))(,)?$"
86+
}
87+
}
88+
}
2489
<#
2590
Integration test should appear below and are custom to the command you are writing.
2691
Read https://github.com/dataplat/dbatools/blob/development/contributing.md#tests
2792
for more guidence.
28-
#>
93+
#>

0 commit comments

Comments
 (0)