Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SecurityOption: Changed setting value - Require Signature #122

Closed
dancs85 opened this issue May 12, 2019 · 1 comment
Closed

SecurityOption: Changed setting value - Require Signature #122

dancs85 opened this issue May 12, 2019 · 1 comment

Comments

@dancs85
Copy link

dancs85 commented May 12, 2019

Validation strings for the item value do not match the strings that apply to registry.

Setting: Domain_controller_LDAP_server_signing_requirements
Correct values (checked on Server 2016): None, Require signing
Current validation strings: [Write, ValueMap{"None","Require Signature"}, Values{"None","Require Signature"}] String Domain_controller_LDAP_server_signing_requirements;
Current registry strings: "Domain_controller_LDAP_server_signing_requirements" = @{ Value = "MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerIntegrity" Section = 'Registry Values' Option = @{ 'None' = '4,1' 'Require Signing' = '4,2' } }
Commit 8ba0cfe seemed to inadvertently introduce the requirement with the incorrect string:
8ba0cfe#diff-0c166052c748e9bb455bb1181a5d65ca

Verbose logs showing the problem

The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: At least one of the values 'Require signing' is not supported or valid for property 'Domain_controller_LDAP_server_signing_requirements' on class 'SecurityOption'. Please specify only supported values:
None, Require Signature.

Suggested solution to the issue

DSCResources/MSFT_SecurityOption/MSFT_SecurityOption.schema.mof
Change Line 30 to:
[Write, ValueMap{"None","Require Signing"}, Values{"None","Require Signing"}] String Domain_controller_LDAP_server_signing_requirements;

The DSC configuration that is used to reproduce the issue (as detailed as possible)

SecurityOption 'Domain Controller Security Options' {
    Name = 'Domain Controller Security Options'
    Domain_controller_LDAP_server_signing_requirements = 'Require Signing'
}

The operating system the target node is running

OsName :
OsOperatingSystemSKU :
OsArchitecture :
WindowsBuildLabEx : 14393.2906.amd64fre.rs1_release_inmarket.190401-180
OsLanguage :
OsMuiLanguages :

Version and build of PowerShell the target node is running

Name Value


PSVersion 5.1.14393.2879
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14393.2879
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

Version of the DSC module that was used ('dev' if using current dev branch)

published (master)

@jcwalker jcwalker mentioned this issue Jul 2, 2019
9 tasks
@X-Guardian
Copy link
Contributor

Fixed as part of PR #125

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants