Sid translation

DSCResources/SecurityPolicyResourceHelper/SecurityPolicyResourceHelper.psm1

@@ -282,7 +282,14 @@ function ConvertTo-LocalFriendlyName
         else
         {
             # if id is an friendly name convert it to a sid and then to an NTAccount
-            $friendlyNames += ( ConvertTo-Sid -Identity $id -Verbose:$VerbosePreference | ConvertTo-NTAccount -Policy $Policy -Scope $Scope )
+            $sidResult = ConvertTo-Sid -Identity $id -Scope $Scope -Verbose:$VerbosePreference
+
+            if ($sidResult -isnot [System.Security.Principal.SecurityIdentifier])
+            {
+                continue
+            }
+
+            $friendlyNames += ConvertTo-NTAccount -SID $sidResult.Value -Policy $Policy -Scope $Scope
         }
     }
 
@@ -388,21 +395,33 @@ function ConvertTo-Sid
     param
     (
         [Parameter()]
-        [String]
-        $Identity
+        [System.String]
+        $Identity,
+
+        [Parameter()]
+        [System.String]
+        $Scope = 'Get'
     )
 
     $id = [System.Security.Principal.NTAccount]$Identity
     try
     {
-        $sid = $id.Translate([System.Security.Principal.SecurityIdentifier])
+        $result = $id.Translate([System.Security.Principal.SecurityIdentifier])
     }
     catch
     {
-        throw "$($script:localizedData.ErrorIdToSid -f $Identity)"
+        if ($Scope -eq 'Get')
+        {
+            Write-Verbose -Message ($script:localizedData.ErrorIdToSid -f $Identity)
+            $result = $id
+        }
+        else
+        {
+            throw "$($script:localizedData.ErrorIdToSid -f $Identity)"
+        }
     }
 
-    return $sid.Value
+    return $result
 }
 
 

README.md

@@ -158,6 +158,7 @@ to ensure the resource configuration instance is unique.
 ## Versions
 
 ### Unreleased
+* Added additional error handling to ConvertTo-Sid helper function.
 
 ### 2.3.0.0
 * Updated documentation.

Tests/Unit/SecurityPolicyResourceHelper.tests.ps1

@@ -38,6 +38,13 @@ try
                     {ConvertTo-LocalFriendlyName -Identity 'S-1-5-32-600' -Scope 'Get'} | Should Not throw
                 }
 
+                It "Should not Throw when Scope is Get and Identity is a unresolvable name" {
+                    {ConvertTo-LocalFriendlyName -Identity 'badName' -Scope 'Get'} | Should Not throw
+                }
+
+                It "Should Throw when Scope is Set and Identity is an unresolvable name" {
+                    {ConvertTo-LocalFriendlyName -Identity 'badName' -Scope 'Set'} | Should throw
+                }
                 It "Should Throw when Scope is 'SET'" {
                     {ConvertTo-LocalFriendlyName -Identity 'S-1-5-32-600' -Scope 'Set'} | Should throw
                 }