{"action":"created","issue":{"url":"https://api.github.com/repos/saltstack/salt/issues/21485","labels_url":"https://api.github.com/repos/saltstack/salt/issues/21485/labels{/name}","comments_url":"https://api.github.com/repos/saltstack/salt/issues/21485/comments","events_url":"https://api.github.com/repos/saltstack/salt/issues/21485/events","html_url":"https://github.com/saltstack/salt/issues/21485","id":60506181,"number":21485,"title":"Feature Request: Manage Windows Local Security Policy Settings","user":{"login":"lorengordon","id":8457307,"avatar_url":"https://avatars.githubusercontent.com/u/8457307?v=3","gravatar_id":"","url":"https://api.github.com/users/lorengordon","html_url":"https://github.com/lorengordon","followers_url":"https://api.github.com/users/lorengordon/followers","following_url":"https://api.github.com/users/lorengordon/following{/other_user}","gists_url":"https://api.github.com/users/lorengordon/gists{/gist_id}","starred_url":"https://api.github.com/users/lorengordon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lorengordon/subscriptions","organizations_url":"https://api.github.com/users/lorengordon/orgs","repos_url":"https://api.github.com/users/lorengordon/repos","events_url":"https://api.github.com/users/lorengordon/events{/privacy}","received_events_url":"https://api.github.com/users/lorengordon/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/saltstack/salt/labels/Feature","name":"Feature","color":"009800"},{"url":"https://api.github.com/repos/saltstack/salt/labels/Platform","name":"Platform","color":"fef2c0"},{"url":"https://api.github.com/repos/saltstack/salt/labels/Windows","name":"Windows","color":"006b75"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/saltstack/salt/milestones/13","html_url":"https://github.com/saltstack/salt/milestones/Approved","labels_url":"https://api.github.com/repos/saltstack/salt/milestones/13/labels","id":9265,"number":13,"title":"Approved","description":"All issues that are ready to be worked on, both bugs and features.","creator":{"login":"thatch45","id":507599,"avatar_url":"https://avatars.githubusercontent.com/u/507599?v=3","gravatar_id":"","url":"https://api.github.com/users/thatch45","html_url":"https://github.com/thatch45","followers_url":"https://api.github.com/users/thatch45/followers","following_url":"https://api.github.com/users/thatch45/following{/other_user}","gists_url":"https://api.github.com/users/thatch45/gists{/gist_id}","starred_url":"https://api.github.com/users/thatch45/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thatch45/subscriptions","organizations_url":"https://api.github.com/users/thatch45/orgs","repos_url":"https://api.github.com/users/thatch45/repos","events_url":"https://api.github.com/users/thatch45/events{/privacy}","received_events_url":"https://api.github.com/users/thatch45/received_events","type":"User","site_admin":false},"open_issues":2542,"closed_issues":2601,"state":"open","created_at":"2011-05-14T04:00:56Z","updated_at":"2015-09-17T16:44:40Z","due_on":null,"closed_at":null},"comments":6,"created_at":"2015-03-10T14:19:32Z","updated_at":"2015-09-17T16:51:06Z","closed_at":null,"body":"I would like to see salt implement a module and a state to manage local security policy objects. I know salt can manage Windows registry settings, but that can be overridden when the local security policy refreshes (which in turn can be overridden by group policy, but that's a feature of Active Directory Domain Services; I'm only referring to the local policy feature). A wrapper around secedit.exe would probably be sufficient. (I don't think there is another mechanism to programatically interface with the local security policy.) \r\n\r\nI haven't seen this capability in many configuration management tools, though Puppet [seems to have modules for it](https://puppetlabs.com/blog/managing-windows-security-policies-puppet-enterprise-two-modules) now. It's interesting that they use the plain English description from the GUI to specify a configuration setting, rather than the name used in the INF for the configuration setting (i.e. 'Password must meet complexity requirements' vs 'PasswordComplexity'). This is a little friendlier for admins and makes it easier for them to find the right syntax. It can be a rather convoluted process to figure out the corresponding INF setting just from what's displayed in the gpedit.msc GUI, so this is rather convenient... I'm betting the Puppet module has a hard-coded lookup table that does the translation. It should be noted that Microsoft has a habit of changing the description in the GUI between versions, which may cause confusion over time with that approach. Personally, I'd like to be able to specify a setting either way. \r\n\r\nA Microsoft programmer has also written a wrapper around secedit.exe, called [Apply_LGPO_Delta.exe](http://blogs.technet.com/b/fdcc/archive/2010/01/15/apply-lgpo-delta-and-importregpol-updated.aspx), and they provide the [source](http://blogs.technet.com/b/fdcc/archive/2010/01/15/updated-lgpo-utility-sources.aspx). It might be useful to study their approach. "},"comment":{"url":"https://api.github.com/repos/saltstack/salt/issues/comments/141146034","html_url":"https://github.com/saltstack/salt/issues/21485#issuecomment-141146034","issue_url":"https://api.github.com/repos/saltstack/salt/issues/21485","id":141146034,"user":{"login":"lomeroe","id":8835244,"avatar_url":"https://avatars.githubusercontent.com/u/8835244?v=3","gravatar_id":"","url":"https://api.github.com/users/lomeroe","html_url":"https://github.com/lomeroe","followers_url":"https://api.github.com/users/lomeroe/followers","following_url":"https://api.github.com/users/lomeroe/following{/other_user}","gists_url":"https://api.github.com/users/lomeroe/gists{/gist_id}","starred_url":"https://api.github.com/users/lomeroe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lomeroe/subscriptions","organizations_url":"https://api.github.com/users/lomeroe/orgs","repos_url":"https://api.github.com/users/lomeroe/repos","events_url":"https://api.github.com/users/lomeroe/events{/privacy}","received_events_url":"https://api.github.com/users/lomeroe/received_events","type":"User","site_admin":false},"created_at":"2015-09-17T16:51:06Z","updated_at":"2015-09-17T16:51:06Z","body":"I've got a module started on this...mainly worked the \"get\" portion, though I've tested out the basics of the \"put\" function in my first test functions (set_password_policy/set_lockout_policy)\r\n\r\nhttps://github.com/lomeroe/salt/blob/add-windows-pol-mgmt/salt/modules/win_secpol.py\r\n\r\nWanted to see what others thought while I was working on finishing it up....\r\n\r\n\r\nexample output:\r\nsalt 'server1*' win_secpol.get return_full_policy_names=True\r\nserver1:\r\n    ----------\r\n    Account lockout duration:\r\n        1440\r\n    Account lockout threshold:\r\n        10\r\n    Accounts: Administrator account status:\r\n        Enabled\r\n    Accounts: Guest account status:\r\n        Disabled\r\n    Accounts: Limit local account use of blank passwords to console logon only:\r\n        Disabled\r\n    Accounts: Rename administrator account:\r\n        Administrator\r\n    Accounts: Rename guest account:\r\n        Guest\r\n    Audit account management:\r\n        No auditing\r\n    Audit directory service access:\r\n        No auditing\r\n    Audit logon events:\r\n        Success\r\n    Audit object access:\r\n        No auditing\r\n    Audit policy change:\r\n        No auditing\r\n    Audit privilege use:\r\n        No auditing\r\n    Audit process tracking:\r\n        No auditing\r\n    Audit system events:\r\n        No auditing\r\n    Enforce password history:\r\n        24\r\n    Maximum password age:\r\n        60\r\n    Minimum password age:\r\n        1\r\n    Minimum password length:\r\n        14\r\n    Network Access: Do not allow anonymous enumeration of SAM accounts and shares:\r\n        Disabled\r\n    Passwords must meet complexity requirements:\r\n        Enabled\r\n    Reset account lockout counter after:\r\n        1440\r\n    Store passwords using reversible encryption:\r\n        Disabled"}}