What happened?
Description:
The lgpo_reg module is intermittently failing to set registry values on Windows Server 2025 Domain Controllers. The issue manifests as a PermissionError (Errno 13) when the module attempts to write to the Registry.pol file.
Analysis:
The module directly manipulates the Registry.pol file located at C:\Windows\System32\GroupPolicy\Machine\Registry.pol. On Domain Controllers, this file is a high-contention resource. It is frequently locked by the Windows Group Policy service (gpsvc) during routine policy refreshes or by system-level synchronization processes.
Because the lgpo_reg module performs a raw file write, it does not currently account for existing file locks held by the OS. When the execution timing coincides with a system-level policy refresh or service access, the OS denies write access, leading to a hard failure.
Traceback:
An exception occurred in this state: Traceback (most recent call last):
File "C:\Program Files\Salt Project\Salt\Lib\site-packages\salt\utils\win_lgpo_reg.py", line 157, in write_reg_pol_data
with salt.utils.files.fopen(policy_file_path, "wb") as pol_file:
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Program Files\Salt Project\Salt\Lib\site-packages\salt\utils\files.py", line 531, in fopen
f_handle = open( # pylint: disable=resource-leakage,unspecified-encoding
*args, **kwargs
)
PermissionError: [Errno 13] Permission denied: 'C:\\Windows\\System32\\GroupPolicy\\Machine\\Registry.pol'
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "C:\Program Files\Salt Project\Salt\Lib\site-packages\salt\state.py", line 2394, in call
ret = self.states[cdata["full"]](
*cdata["args"], **cdata["kwargs"]
)
File "C:\Program Files\Salt Project\Salt\Lib\site-packages\salt\loader\lazy.py", line 177, in __call__
ret = self.loader.run(run_func, *args, **kwargs)
...
File "C:\Program Files\Salt Project\Salt\Lib\site-packages\salt\modules\win_lgpo_reg.py", line 519, in set_value
if not write_reg_pol(pol_data, policy_class=policy_class):
~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Program Files\Salt Project\Salt\Lib\site-packages\salt\modules\win_lgpo_reg.py", line 206, in write_reg_pol
return salt.utils.win_lgpo_reg.write_reg_pol_data(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
policy_file_data,
^^^^^^^^^^^^^^^^^
...
File "C:\Program Files\Salt Project\Salt\Lib\site-packages\salt\utils\win_lgpo_reg.py", line 172, in write_reg_pol_data
raise CommandExecutionError(msg)
salt.exceptions.CommandExecutionError: An error occurred attempting to write to registry.pol
PATH: C:\Windows\System32\GroupPolicy\Machine\Registry.pol
EXCEPTION: [Errno 13] Permission denied: 'C:\\Windows\\System32\\GroupPolicy\\Machine\\Registry.pol'
Type of salt install
Official exe
Major version
3006.x
What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)
windows-2025
salt --versions-report output
What happened?
Description:
The lgpo_reg module is intermittently failing to set registry values on Windows Server 2025 Domain Controllers. The issue manifests as a PermissionError (Errno 13) when the module attempts to write to the Registry.pol file.
Analysis:
The module directly manipulates the Registry.pol file located at C:\Windows\System32\GroupPolicy\Machine\Registry.pol. On Domain Controllers, this file is a high-contention resource. It is frequently locked by the Windows Group Policy service (gpsvc) during routine policy refreshes or by system-level synchronization processes.
Because the lgpo_reg module performs a raw file write, it does not currently account for existing file locks held by the OS. When the execution timing coincides with a system-level policy refresh or service access, the OS denies write access, leading to a hard failure.
Traceback:
Type of salt install
Official exe
Major version
3006.x
What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)
windows-2025
salt --versions-report output