Fix mismatch between user and builtinaccount (#387)

dsccommunity · Nov 23, 2022 · 6c3f2fd · 6c3f2fd
1 parent 3aea926
commit 6c3f2fd
Show file tree

Hide file tree

Showing 3 changed files with 47 additions and 15 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- ScheduledTask
+  - No longer conflates resource parameter `BuiltInAccount` and `*-ScheduledTask` parameter `user` - Fixes [Issue #385](https://github.com/dsccommunity/ComputerManagementDsc/issues/385)
+
 ### Added
 
 - Computer

diff --git a/source/DSCResources/DSC_ScheduledTask/DSC_ScheduledTask.psm1 b/source/DSCResources/DSC_ScheduledTask/DSC_ScheduledTask.psm1
@@ -792,7 +792,7 @@ function Set-TargetResource
                 non-null value to be 'LOCAL SERVICE', 'NETWORK SERVICE' or
                 'SYSTEM'
             #>
-            $username = 'NT AUTHORITY\' + $BuiltInAccount
+            $username = Set-DomainNameInAccountName -AccountName $BuiltInAccount -DomainName 'NT AUTHORITY'
             $registerArguments.Add('User', $username)
             $LogonType = 'ServiceAccount'
         }
@@ -804,7 +804,6 @@ function Set-TargetResource
         elseif ($PSBoundParameters.ContainsKey('ExecuteAsCredential'))
         {
             $username = $ExecuteAsCredential.UserName
-
             # If the LogonType is not specified then set it to password
             if ([System.String]::IsNullOrEmpty($LogonType))
             {
@@ -829,7 +828,7 @@ function Set-TargetResource
                 privileges, should we default to 'NT AUTHORITY\LOCAL SERVICE'
                 instead?
             #>
-            $username = 'NT AUTHORITY\SYSTEM'
+            $username = Set-DomainNameInAccountName -AccountName 'SYSTEM' -DomainName 'NT AUTHORITY'
             $registerArguments.Add('User', $username)
             $LogonType = 'ServiceAccount'
         }
@@ -1423,16 +1422,17 @@ function Test-TargetResource
 
     if ($PSBoundParameters.ContainsKey('BuiltInAccount'))
     {
-        $PSBoundParameters.User = $BuiltInAccount
-        $currentValues.User = $BuiltInAccount
+        $user = Set-DomainNameInAccountName -AccountName 'SYSTEM' -DomainName 'NT AUTHORITY'
+        $PSBoundParameters.User = $user
+        $currentValues.User = $user
 
         $PSBoundParameters.ExecuteAsCredential = $BuiltInAccount
         $currentValues.ExecuteAsCredential = $BuiltInAccount
 
         $PSBoundParameters['LogonType'] = 'ServiceAccount'
         $currentValues['LogonType'] = 'ServiceAccount'
 
-        $PSBoundParameters['BuiltInAccount'] = 'NT AUTHORITY\' + $BuiltInAccount
+        $PSBoundParameters['BuiltInAccount'] = $BuiltInAccount
     }
     elseif ($PSBoundParameters.ContainsKey('ExecuteAsCredential'))
     {
@@ -1464,6 +1464,16 @@ function Test-TargetResource
     }
     else
     {
+        $user = Set-DomainNameInAccountName -AccountName 'SYSTEM' -DomainName 'NT AUTHORITY'
+        $PSBoundParameters.User = $user
+        $currentValues.User = $user
+
+        $PSBoundParameters.ExecuteAsCredential = 'SYSTEM'
+        $currentValues.ExecuteAsCredential = 'SYSTEM'
+
+        $PSBoundParameters.Add('BuiltInAccount', $BuiltInAccount)
+        $currentValues.BuiltInAccount = $BuiltInAccount
+
         # Must be running as System, login type is ServiceAccount
         $PSBoundParameters['LogonType'] = 'ServiceAccount'
         $currentValues['LogonType'] = 'ServiceAccount'
@@ -1915,9 +1925,15 @@ function Get-CurrentResource
             Delay                           = ConvertTo-TimeSpanStringFromScheduledTaskString -TimeSpan $trigger.Delay
         }
 
-        if (($result.ContainsKey('LogonType')) -and ($result['LogonType'] -ieq 'ServiceAccount'))
+        if (
+            (($result.ContainsKey('LogonType')) -and ($result['LogonType'] -ieq 'ServiceAccount')) -or
+            $result.Principal.UserID -in @('SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE')
+            )
         {
-            $builtInAccount = Set-DomainNameInAccountName -AccountName $task.Principal.UserId -DomainName 'NT AUTHORITY'
+            $result.User = Set-DomainNameInAccountName `
+                -AccountName $task.Principal.UserId `
+                -DomainName 'NT AUTHORITY'
+            $builtInAccount = $task.Principal.UserId
             $result.Add('BuiltInAccount', $builtInAccount)
         }
     }

diff --git a/tests/Unit/DSC_ScheduledTask.Tests.ps1 b/tests/Unit/DSC_ScheduledTask.Tests.ps1
@@ -1788,6 +1788,15 @@ try
                     }
                 }
 
+                $testParameters.Add('User', 'WrongUser')
+
+                It 'Should Disregard User and Set User to the BuiltInAccount' {
+                    Set-TargetResource @testParameters
+                    Assert-MockCalled -CommandName Register-ScheduledTask -Times 1 -Scope It -ParameterFilter {
+                        $User -ieq ('NT AUTHORITY\' + $testParameters['BuiltInAccount'])
+                    }
+                }
+
                 $testParameters.Add('LogonType', 'Password')
 
                 It 'Should overwrite LogonType to "ServiceAccount"' {
@@ -1799,14 +1808,16 @@ try
 
                 Mock -CommandName Get-ScheduledTask -MockWith {
                     @{
-                        TaskName  = $testParameters.TaskName
-                        TaskPath  = $testParameters.TaskPath
-                        Actions   = @(
+                        Description = '+'
+                        TaskName    = $testParameters.TaskName
+                        TaskPath    = $testParameters.TaskPath
+                        Actions     = @(
                             [pscustomobject] @{
                                 Execute = $testParameters.ActionExecutable
                             }
                         )
-                        Triggers  = @(
+                        ActionArguments = '-File "C:\something\right.ps1"'
+                        Triggers    = @(
                             [pscustomobject] @{
                                 Repetition = @{
                                     Duration = "PT$([System.TimeSpan]::Parse($testParameters.RepetitionDuration).TotalHours)H"
@@ -1817,12 +1828,12 @@ try
                                 }
                             }
                         )
-                        Settings = [pscustomobject] @{
+                        Settings    = [pscustomobject] @{
                             Enabled = $true
                             MultipleInstances = 'IgnoreNew'
                         }
-                        Principal = [pscustomobject] @{
-                            UserId    = 'NT AUTHORITY\' + $testParameters.BuiltInAccount
+                        Principal   = [pscustomobject] @{
+                            UserId    = $testParameters.BuiltInAccount
                             LogonType = 'ServiceAccount'
                         }
                     }