PowerSTIG 4.30.0 generates malformed UserRightRule identities for the Windows Server 2025 Member Server STIG 1.1.
Identity names contain trailing sentence periods:
<Identity>Administrators.</Identity>
Some rules contain multiple affected identities:
<Identity>Administrators.,Service.,Local Service.,Network Service.</Identity>
SecurityPolicyDsc cannot translate these malformed names to SIDs:
PowerShell DSC resource MSFT_UserRightsAssignment failed to execute
Set-TargetResource functionality with error message:
Could not convert Identity: Administrators. to SID
The workaround at this time is to create Exceptions for each one:
Exception = @{
'V-278183' = @{ Identity = 'Administrators, Authenticated Users' }
'V-278185' = @{ Identity = 'Enterprise Admins, Domain Admins, Guests' }
'V-278186' = @{ Identity = 'Guests' }
'V-278187' = @{ Identity = 'Enterprise Admins, Domain Admins, Guests' }
'V-278188' = @{ Identity = 'Guests' }
'V-278243' = @{ Identity = 'Administrators' }
'V-278244' = @{ Identity = 'Administrators' }
'V-278245' = @{ Identity = 'Administrators' }
'V-278247' = @{
Identity = 'Administrators, SERVICE, LOCAL SERVICE, NETWORK SERVICE'
}
'V-278249' = @{ Identity = 'Administrators' }
'V-278250' = @{ Identity = 'Administrators' }
'V-278251' = @{ Identity = 'Administrators' }
'V-278252' = @{
Identity = 'LOCAL SERVICE, NETWORK SERVICE'
}
'V-278253' = @{
Identity = 'Administrators, SERVICE, LOCAL SERVICE, NETWORK SERVICE'
}
'V-278254' = @{ Identity = 'Administrators' }
'V-278255' = @{ Identity = 'Administrators' }
'V-278257' = @{ Identity = 'Administrators' }
'V-278258' = @{ Identity = 'Administrators' }
'V-278259' = @{ Identity = 'Administrators' }
'V-278260' = @{ Identity = 'Administrators' }
'V-278261' = @{ Identity = 'Administrators' }
'V-278262' = @{ Identity = 'Administrators' }
}
PowerSTIG 4.30.0 generates malformed
UserRightRuleidentities for the Windows Server 2025 Member Server STIG 1.1.Identity names contain trailing sentence periods:
Some rules contain multiple affected identities:
SecurityPolicyDsc cannot translate these malformed names to SIDs:
The workaround at this time is to create Exceptions for each one: