microsoft / microsoft/PowerStig

Windows Server 2025 STIG 1.1 user-right identities contain trailing periods

Open
#1,560 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PowerShell
Stars
619
Forks
124
PR merge metrics
No merged PRs in 30d

Description

PowerSTIG 4.30.0 generates malformed UserRightRule identities for the Windows Server 2025 Member Server STIG 1.1.

Identity names contain trailing sentence periods:

<Identity>Administrators.</Identity>

Some rules contain multiple affected identities:

<Identity>Administrators.,Service.,Local Service.,Network Service.</Identity>

SecurityPolicyDsc cannot translate these malformed names to SIDs:

PowerShell DSC resource MSFT_UserRightsAssignment failed to execute
Set-TargetResource functionality with error message:
Could not convert Identity: Administrators. to SID

The workaround at this time is to create Exceptions for each one:

Exception = @{
    'V-278183' = @{ Identity = 'Administrators, Authenticated Users' }
    'V-278185' = @{ Identity = 'Enterprise Admins, Domain Admins, Guests' }
    'V-278186' = @{ Identity = 'Guests' }
    'V-278187' = @{ Identity = 'Enterprise Admins, Domain Admins, Guests' }
    'V-278188' = @{ Identity = 'Guests' }
    'V-278243' = @{ Identity = 'Administrators' }
    'V-278244' = @{ Identity = 'Administrators' }
    'V-278245' = @{ Identity = 'Administrators' }
    'V-278247' = @{
        Identity = 'Administrators, SERVICE, LOCAL SERVICE, NETWORK SERVICE'
    }
    'V-278249' = @{ Identity = 'Administrators' }
    'V-278250' = @{ Identity = 'Administrators' }
    'V-278251' = @{ Identity = 'Administrators' }
    'V-278252' = @{
        Identity = 'LOCAL SERVICE, NETWORK SERVICE'
    }
    'V-278253' = @{
        Identity = 'Administrators, SERVICE, LOCAL SERVICE, NETWORK SERVICE'
    }
    'V-278254' = @{ Identity = 'Administrators' }
    'V-278255' = @{ Identity = 'Administrators' }
    'V-278257' = @{ Identity = 'Administrators' }
    'V-278258' = @{ Identity = 'Administrators' }
    'V-278259' = @{ Identity = 'Administrators' }
    'V-278260' = @{ Identity = 'Administrators' }
    'V-278261' = @{ Identity = 'Administrators' }
    'V-278262' = @{ Identity = 'Administrators' }
}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the PowerStig 4.30.0 generation path for Windows Server 2025 Member Server STIG 1.1 UserRightRule identities. Reproduce the generated XML and check the affected identities, including multiple comma-separated values; done means identities no longer contain trailing periods and SecurityPolicyDsc can translate them to SIDs without the listed exceptions.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.