diff --git a/DSCResources/SecurityPolicyResourceHelper/SecurityPolicyResourceHelper.psm1 b/DSCResources/SecurityPolicyResourceHelper/SecurityPolicyResourceHelper.psm1 index 1413609..d452426 100644 --- a/DSCResources/SecurityPolicyResourceHelper/SecurityPolicyResourceHelper.psm1 +++ b/DSCResources/SecurityPolicyResourceHelper/SecurityPolicyResourceHelper.psm1 @@ -282,7 +282,14 @@ function ConvertTo-LocalFriendlyName else { # if id is an friendly name convert it to a sid and then to an NTAccount - $friendlyNames += ( ConvertTo-Sid -Identity $id -Verbose:$VerbosePreference | ConvertTo-NTAccount -Policy $Policy -Scope $Scope ) + $sidResult = ConvertTo-Sid -Identity $id -Scope $Scope -Verbose:$VerbosePreference + + if ($sidResult -isnot [System.Security.Principal.SecurityIdentifier]) + { + continue + } + + $friendlyNames += ConvertTo-NTAccount -SID $sidResult.Value -Policy $Policy -Scope $Scope } } @@ -388,21 +395,33 @@ function ConvertTo-Sid param ( [Parameter()] - [String] - $Identity + [System.String] + $Identity, + + [Parameter()] + [System.String] + $Scope = 'Get' ) $id = [System.Security.Principal.NTAccount]$Identity try { - $sid = $id.Translate([System.Security.Principal.SecurityIdentifier]) + $result = $id.Translate([System.Security.Principal.SecurityIdentifier]) } catch { - throw "$($script:localizedData.ErrorIdToSid -f $Identity)" + if ($Scope -eq 'Get') + { + Write-Verbose -Message ($script:localizedData.ErrorIdToSid -f $Identity) + $result = $id + } + else + { + throw "$($script:localizedData.ErrorIdToSid -f $Identity)" + } } - return $sid.Value + return $result } diff --git a/Misc/TestHelpers/sample.inf b/Misc/TestHelpers/sample.inf index 8f86ae6..1bb2c16 100644 Binary files a/Misc/TestHelpers/sample.inf and b/Misc/TestHelpers/sample.inf differ diff --git a/README.md b/README.md index 0471001..a7c1af5 100644 --- a/README.md +++ b/README.md @@ -158,6 +158,7 @@ to ensure the resource configuration instance is unique. ## Versions ### Unreleased +* Added additional error handling to ConvertTo-Sid helper function. ### 2.3.0.0 * Updated documentation. diff --git a/Tests/Unit/SecurityPolicyResourceHelper.tests.ps1 b/Tests/Unit/SecurityPolicyResourceHelper.tests.ps1 index 0e2c46a..333b3ab 100644 --- a/Tests/Unit/SecurityPolicyResourceHelper.tests.ps1 +++ b/Tests/Unit/SecurityPolicyResourceHelper.tests.ps1 @@ -38,6 +38,13 @@ try {ConvertTo-LocalFriendlyName -Identity 'S-1-5-32-600' -Scope 'Get'} | Should Not throw } + It "Should not Throw when Scope is Get and Identity is a unresolvable name" { + {ConvertTo-LocalFriendlyName -Identity 'badName' -Scope 'Get'} | Should Not throw + } + + It "Should Throw when Scope is Set and Identity is an unresolvable name" { + {ConvertTo-LocalFriendlyName -Identity 'badName' -Scope 'Set'} | Should throw + } It "Should Throw when Scope is 'SET'" { {ConvertTo-LocalFriendlyName -Identity 'S-1-5-32-600' -Scope 'Set'} | Should throw }