Ensure random windows password satisfies policy

Signed-off-by: Jeremiah Snapp <[email protected]>

Author: jeremiahsnapp

packer/windows/conf/bin/bk-install-elastic-stack.ps1

@@ -119,32 +119,29 @@ Set-PSDebug -Trace 0
 
 Write-Output "Creating buildkite-agent user account in Administrators group"
 
-$UserName = "buildkite-agent"
+$lowerChars = [char[]](97..122)  # a-z
+$upperChars = [char[]](65..90)   # A-Z
+$numbers = [char[]](48..57)      # 0-9
+$specialChars = [char[]](40, 41, 33, 64, 36, 37, 45, 61, 46, 63, 42, 59, 38)  # ()!@$%-=.?*;&
 
-$StopLoop = $false
-[int]$RetryCount = "0"
+$minPasswordLength = 32
+$randomChars = @()
 
-# a Try/Catch block is used in a loop to make a few extra attempts at creating the user account before finally giving up and failing
-# because sometimes the generated random password does not satisfy the system's password policy
 Do {
-  Try {
-    $Count = Get-Random -min 24 -max 32
-    $Password = -join ((65..90) + (97..122) + (48..57) | Get-Random -Count $Count | ForEach-Object {[char]$_})
+  $randomChars += Get-Random -Count 1 -InputObject $lowerChars
+  $randomChars += Get-Random -Count 1 -InputObject $upperChars
+  $randomChars += Get-Random -Count 1 -InputObject $numbers
+  $randomChars += Get-Random -Count 1 -InputObject $specialChars
 
-    New-LocalUser -Name $UserName -PasswordNeverExpires -Password ($Password | ConvertTo-SecureString -AsPlainText -Force) | out-null
-    $StopLoop = $true
-  }
-  Catch {
-    If ($RetryCount -gt 10){
-      Write-Output "Could not create $UserName user after 10 retries."
-      exit 1
-    }
-    Else {
-      Write-Output "Could not create $UserName user, retrying..."
-      $RetryCount = $RetryCount + 1
-    }
-  }
-} While ($StopLoop -eq $false)
+  # randomize the order of the random characters
+  $randomChars = Get-Random -Count $randomChars.Length -InputObject $randomChars
+} While ($randomChars.Length -lt $minPasswordLength)
+
+$Password = -join $randomChars
+
+$UserName = "buildkite-agent"
+
+New-LocalUser -Name $UserName -PasswordNeverExpires -Password ($Password | ConvertTo-SecureString -AsPlainText -Force) | out-null
 
 If ($Env:BUILDKITE_WINDOWS_ADMINISTRATOR -eq "true") {
   Add-LocalGroupMember -Group "Administrators" -Member $UserName | out-null