Skip to content

Commit 5d2fac4

Browse files
arampricearamprice
committed
Powershel: refactor Enable-LocalSecurityPolicy
This method was previously not tested, only it's invocation. This commit changes the contents of Enable-LocalSecurityPolicy to move several external checks (os, presence of LGPO.exe) inside the method and tests its invocation of LGPO.exe explicitly. This change switches from "bare" invocations of LGPO.exe to the use of `Invoke-Expression` which should be equivalent for the commands in question.
1 parent aad64f0 commit 5d2fac4

File tree

2 files changed

+96
-118
lines changed

2 files changed

+96
-118
lines changed

‎modules/BOSH.Sysprep/BOSH.Sysprep.Tests.ps1‎

Lines changed: 78 additions & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,10 @@ BeforeAll {
55

66

77
InModuleScope BOSH.Sysprep {
8-
function GCESysprep {} # See: https://cloud.google.com/compute/docs/instances/windows/creating-windows-os-image
9-
Mock GCESysprep {}
8+
function GCESysprep
9+
{
10+
} # See: https://cloud.google.com/compute/docs/instances/windows/creating-windows-os-image
11+
Mock GCESysprep { }
1012
}
1113
function New-TempDir
1214
{
@@ -26,12 +28,8 @@ Describe "BOSH.Sysprep" {
2628
Mock -ModuleName BOSH.Sysprep Stop-Computer { }
2729
Mock -ModuleName BOSH.Sysprep Start-Process { }
2830

29-
Mock -ModuleName BOSH.Sysprep Get-OSVersion { "windows2019" }
30-
31-
$lgpoExists = $True
32-
Mock -ModuleName BOSH.Sysprep Test-Path { $lgpoExists } -ParameterFilter {
33-
$Path -eq "C:\Windows\LGPO.exe"
34-
}
31+
Mock -ModuleName BOSH.Sysprep -CommandName Get-OSVersion { "windows2019" }
32+
Mock -ModuleName BOSH.Sysprep -CommandName Enable-LocalSecurityPolicy { }
3533
}
3634

3735
Context "when not provided an IaaS" {
@@ -53,14 +51,20 @@ Describe "BOSH.Sysprep" {
5351
Context "for AWS" {
5452
BeforeEach {
5553
Mock -ModuleName BOSH.Sysprep Set-NTP-Max-PhaseCorrection-Values { }
56-
Mock -ModuleName BOSH.Sysprep Enable-LocalSecurityPolicy { }
5754

5855
Mock -ModuleName BOSH.Sysprep Disable-AgentService { }
5956
Mock -ModuleName BOSH.Sysprep Update-AWS-LaunchConfigJSON { }
6057
Mock -ModuleName BOSH.Sysprep Update-AWS-UnattendedXML { }
6158
Mock -ModuleName BOSH.Sysprep Enable-AWS-Sysprep { }
6259
}
6360

61+
It "disables the bosh agent service, and sets a local secrity policy" {
62+
{ Invoke-Sysprep -IaaS "aws" } | Should -Not -Throw
63+
64+
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Disable-AgentService
65+
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Enable-LocalSecurityPolicy
66+
}
67+
6468
It "updates launchconfig.json, unattended.xml and calls Enable-AWS-Sysprep" {
6569
{ Invoke-Sysprep -Iaas "aws" } | Should -Not -Throw
6670

@@ -69,107 +73,61 @@ Describe "BOSH.Sysprep" {
6973
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Enable-AWS-Sysprep
7074
}
7175

72-
Describe "LGPO" {
73-
It "enables local security policy with 'cis-merge-2019'" {
74-
$ExpectedPath = Join-Path $PSScriptRoot "cis-merge-2019"
75-
{ Invoke-Sysprep -Iaas "aws" } | Should -Not -Throw
76-
77-
Should -Invoke -ModuleName BOSH.Sysprep `
78-
-CommandName Enable-LocalSecurityPolicy -Times 1 -ParameterFilter {
79-
$PolicySource -eq $ExpectedPath
80-
}
81-
}
82-
83-
Context "when '-SkipLGPO' is set" {
84-
It "skips local policy update if -SkipLGPO is set" {
85-
{ Invoke-Sysprep -Iaas "aws" -SkipLGPO } | Should -Not -Throw
86-
87-
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Enable-LocalSecurityPolicy -Times 0
88-
}
89-
}
90-
91-
Context "if LGPO.exe is not found" {
92-
BeforeEach {
93-
$lgpoExists = $False
94-
}
76+
Context "when '-SkipLGPO' is set" {
77+
It "skips local policy update if -SkipLGPO is set" {
78+
{ Invoke-Sysprep -Iaas "aws" -SkipLGPO } | Should -Not -Throw
9579

96-
It "throws an error" {
97-
{ Invoke-Sysprep -Iaas "aws" } | Should -Throw
98-
}
80+
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Enable-LocalSecurityPolicy -Times 0
9981
}
10082
}
10183
}
10284

10385
Context "for GCP" {
10486
BeforeEach {
10587
Mock -ModuleName BOSH.Sysprep Set-NTP-Max-PhaseCorrection-Values { }
106-
Mock -ModuleName BOSH.Sysprep Enable-LocalSecurityPolicy { }
10788

10889
Mock -ModuleName BOSH.Sysprep Disable-AgentService { }
10990
Mock -ModuleName BOSH.Sysprep Create-GCP-UnattendXML { }
11091
Mock -ModuleName BOSH.Sysprep GCESysprep { }
11192
}
11293

113-
It "disables the bosh agent service" {
94+
It "disables the bosh agent service, and sets a local secrity policy" {
11495
{ Invoke-Sysprep -IaaS "gcp" } | Should -Not -Throw
11596

11697
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Disable-AgentService
98+
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Enable-LocalSecurityPolicy
11799
}
118100

119-
It "creates an unattend.xml file and calls Google's sysprep command" {
101+
It "disables the bosh agent service, creates an unattend.xml file, and calls Google's sysprep command" {
120102
{ Invoke-Sysprep -IaaS "gcp" } | Should -Not -Throw
121103

122104
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Create-GCP-UnattendXML
123105
Should -Invoke -ModuleName BOSH.Sysprep -CommandName GCESysprep
124106
}
125107

126-
Describe "LGPO" {
127-
Context "when OS is windows2019" {
128-
It "enables local security policy with 'cis-merge-2019'" {
129-
$ExpectedPath = Join-Path $PSScriptRoot "cis-merge-2019"
130-
{ Invoke-Sysprep -Iaas "gcp" } | Should -Not -Throw
131-
132-
Should -Invoke -ModuleName BOSH.Sysprep `
133-
-CommandName Enable-LocalSecurityPolicy -Times 1 -ParameterFilter {
134-
$PolicySource -eq $ExpectedPath
135-
}
136-
}
137-
138-
Context "when '-SkipLGPO' is set" {
139-
It "skips local policy update if -SkipLGPO is set" {
140-
{ Invoke-Sysprep -Iaas "gcp" -SkipLGPO } | Should -Not -Throw
141-
142-
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Enable-LocalSecurityPolicy -Times 0
143-
}
144-
}
145-
146-
Context "if LGPO.exe is not found" {
147-
BeforeEach {
148-
$lgpoExists = $False
149-
}
150-
151-
It "throws an error" {
152-
{ Invoke-Sysprep -Iaas "gcp" } | Should -Throw
153-
}
154-
}
108+
Context "when '-SkipLGPO' is set" {
109+
It "skips local policy update if -SkipLGPO is set" {
110+
{ Invoke-Sysprep -Iaas "gcp" -SkipLGPO } | Should -Not -Throw
111+
112+
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Enable-LocalSecurityPolicy -Times 0
155113
}
156114
}
157115
}
158116

159117
Context "for vSphere" {
160118
BeforeEach {
161119
Mock -ModuleName BOSH.Sysprep Set-NTP-Max-PhaseCorrection-Values { }
162-
Mock -ModuleName BOSH.Sysprep Enable-LocalSecurityPolicy { }
163120

164121
Mock -ModuleName BOSH.Sysprep Disable-AgentService { }
165122
Mock -ModuleName BOSH.Sysprep Create-vSphere-Unattend { }
166123
Mock -ModuleName BOSH.Sysprep Invoke-Expression { }
167124
}
168125

169-
It "disables the bosh agent service" {
126+
It "disables the bosh agent service, and sets a local secrity policy" {
170127
{ Invoke-Sysprep -IaaS "vsphere" } | Should -Not -Throw
171128

172129
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Disable-AgentService
130+
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Enable-LocalSecurityPolicy
173131
}
174132

175133
It "creates an unattend.xml file" {
@@ -187,38 +145,6 @@ Describe "BOSH.Sysprep" {
187145
$Command -eq 'C:/windows/system32/sysprep/sysprep.exe /generalize /oobe /unattend:"C:/Windows/Panther/Unattend/unattend.xml" /quiet /shutdown'
188146
}
189147
}
190-
191-
Describe "LGPO" {
192-
Context "when OS is windows2019" {
193-
It "enables local security policy with 'cis-merge-2019'" {
194-
$ExpectedPath = Join-Path $PSScriptRoot "cis-merge-2019"
195-
{ Invoke-Sysprep -Iaas "vsphere" } | Should -Not -Throw
196-
197-
Should -Invoke -ModuleName BOSH.Sysprep `
198-
-CommandName Enable-LocalSecurityPolicy -Times 1 -ParameterFilter {
199-
$PolicySource -eq $ExpectedPath
200-
}
201-
}
202-
203-
Context "when '-SkipLGPO' is set" {
204-
It "skips local policy update if -SkipLGPO is set" {
205-
{ Invoke-Sysprep -Iaas "vsphere" -SkipLGPO } | Should -Not -Throw
206-
207-
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Enable-LocalSecurityPolicy -Times 0
208-
}
209-
}
210-
211-
Context "if LGPO.exe is not found" {
212-
BeforeEach {
213-
$lgpoExists = $False
214-
}
215-
216-
It "throws an error" {
217-
{ Invoke-Sysprep -Iaas "vsphere" } | Should -Throw
218-
}
219-
}
220-
}
221-
}
222148
}
223149
}
224150

@@ -405,4 +331,55 @@ Describe "BOSH.Sysprep" {
405331
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Config" -Name 'MaxPosPhaseCorrection' -Value $oldMaxPosPhaseCorrection
406332
}
407333
}
334+
335+
Describe "Enable-LocalSecurityPolicy" {
336+
BeforeEach {
337+
Mock -ModuleName BOSH.Sysprep -CommandName Get-OSVersion { "windows2019" }
338+
339+
$expectedPolicyDir = Join-Path $PSScriptRoot "cis-merge-2019"
340+
$domainSysVolDir = "$expectedPolicyDir/DomainSysvol"
341+
$machinePolicyDir = "$domainSysVolDir/GPO/Machine"
342+
$userPolicyDir = "$domainSysVolDir/GPO/User"
343+
344+
$lgpoExePath = "C:\Windows\LGPO.exe"
345+
Mock -ModuleName BOSH.Sysprep Test-Path { $True } -ParameterFilter { $Path -eq $lgpoExePath }
346+
}
347+
348+
It "invokes LGPO.exe the expected files" {
349+
$invokedExpressions = New-Object System.Collections.ArrayList
350+
Mock -ModuleName BOSH.Sysprep -CommandName Invoke-Expression {
351+
$invokedExpressions.Add($Command)
352+
return 0
353+
}
354+
355+
{ Enable-LocalSecurityPolicy } | Should -Not -Throw
356+
357+
Should -Invoke -ModuleName BOSH.Sysprep -CommandName Invoke-Expression -Times 3
358+
$invokedExpressions | Should -Be @(
359+
"$lgpoExePath /r '$machinePolicyDir/registry.txt' /w '$machinePolicyDir/registry.pol'",
360+
"$lgpoExePath /r '$userPolicyDir/registry.txt' /w '$userPolicyDir/registry.pol'",
361+
"$lgpoExePath /g '$domainSysVolDir' /v"
362+
)
363+
}
364+
365+
Context "when OS is unknown" {
366+
BeforeEach {
367+
Mock -ModuleName BOSH.Sysprep -CommandName Get-OSVersion { "windows-unknown" }
368+
}
369+
370+
It "throws an error" {
371+
{ Enable-LocalSecurityPolicy } | Should -Throw
372+
}
373+
}
374+
375+
Context "when LGPO.exe is not found" {
376+
BeforeEach {
377+
Mock -ModuleName BOSH.Sysprep Test-Path { $False } -ParameterFilter { $Path -eq "C:\Windows\LGPO.exe" }
378+
}
379+
380+
It "throws an error" {
381+
{ Enable-LocalSecurityPolicy } | Should -Throw
382+
}
383+
}
384+
}
408385
}

‎modules/BOSH.Sysprep/BOSH.Sysprep.psm1‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -21,17 +21,7 @@ function Invoke-Sysprep {
2121

2222
if (-Not $SkipLGPO)
2323
{
24-
if (-Not (Test-Path "C:\Windows\LGPO.exe")) {
25-
Throw "Error: LGPO.exe is expected to be installed to C:\Windows\LGPO.exe"
26-
}
27-
28-
$OsVersion = Get-OSVersion
29-
switch ($OsVersion)
30-
{
31-
"windows2019" {
32-
Enable-LocalSecurityPolicy (Join-Path $PSScriptRoot "cis-merge-2019")
33-
}
34-
}
24+
Enable-LocalSecurityPolicy
3525
}
3626

3727
switch ($IaaS) {
@@ -67,26 +57,37 @@ function Invoke-Sysprep {
6757
This cmdlet enables enabling a local security policy for a stemcell
6858
#>
6959
function Enable-LocalSecurityPolicy {
70-
Param (
71-
[string]$PolicySource =$(throw "Policy backup filepath is required")
72-
)
7360
Write-Log "Starting LocalSecurityPolicy"
7461

62+
$OsVersion = Get-OSVersion
63+
switch ($OsVersion)
64+
{
65+
"windows2019" {
66+
$PolicySource = (Join-Path $PSScriptRoot "cis-merge-2019")
67+
}
68+
Default { Throw "Policy backup filepath could not be determined from OS: $OsVersion" }
69+
}
70+
71+
$lgpoExePath = "C:\Windows\LGPO.exe"
72+
if (-Not (Test-Path $lgpoExePath)) {
73+
Throw "Error: LGPO.exe is expected to be installed to C:\Windows\LGPO.exe"
74+
}
75+
7576
# Convert registry.txt files into registry.pol files
7677
$MachineDir="$PolicySource/DomainSysvol/GPO/Machine"
77-
LGPO.exe /r "$MachineDir/registry.txt" /w "$MachineDir/registry.pol"
78+
Invoke-Expression "$lgpoExePath /r '$MachineDir/registry.txt' /w '$MachineDir/registry.pol'"
7879
if ($LASTEXITCODE -ne 0) {
7980
Write-Error "Generating policy: Machine"
8081
}
8182

8283
$UserDir="$PolicySource/DomainSysvol/GPO/User"
83-
LGPO.exe /r "$UserDir/registry.txt" /w "$UserDir/registry.pol"
84+
Invoke-Expression "$lgpoExePath /r '$UserDir/registry.txt' /w '$UserDir/registry.pol'"
8485
if ($LASTEXITCODE -ne 0) {
8586
Write-Error "Generating policy: User"
8687
}
8788

8889
# Apply policies
89-
LGPO.exe /g "$PolicySource/DomainSysvol" /v
90+
Invoke-Expression "$lgpoExePath /g '$PolicySource/DomainSysvol' /v"
9091
if ($LASTEXITCODE -ne 0) {
9192
Write-Error "Applying policy: $PolicySource/DomainSysvol"
9293
}

0 commit comments

Comments
 (0)