chef 16.1.16 → 16.18.30

data/lib/chef/resource/windows_firewall_rule.rb

@@ -19,11 +19,11 @@
 # limitations under the License.
 #
 
-require_relative "../json_compat"
-
 class Chef
   class Resource
     class WindowsFirewallRule < Chef::Resource
+      unified_mode true
+
       provides :windows_firewall_rule
 
       description "Use the **windows_firewall_rule** resource to create, change or remove Windows firewall rules."
@@ -157,11 +157,11 @@ class Chef
 
       load_current_value do
         load_state_cmd = load_firewall_state(rule_name)
-        output = powershell_out(load_state_cmd)
-        if output.stdout.empty?
+        output = powershell_exec(load_state_cmd)
+        if output.result.empty?
           current_value_does_not_exist!
         else
-          state = Chef::JSONCompat.from_json(output.stdout)
+          state = output.result
         end
 
         # Need to reverse `$rule.Profile.ToString()` in powershell command
@@ -192,17 +192,17 @@ class Chef
             :remote_port, :direction, :protocol, :icmp_type, :firewall_action, :profile, :program, :service,
             :interface_type, :enabled do
               cmd = firewall_command("Set")
-              powershell_out!(cmd)
+              powershell_exec!(cmd)
             end
           converge_if_changed :group do
-            powershell_out!("Remove-NetFirewallRule -Name '#{new_resource.rule_name}'")
+            powershell_exec!("Remove-NetFirewallRule -Name '#{new_resource.rule_name}'")
             cmd = firewall_command("New")
-            powershell_out!(cmd)
+            powershell_exec!(cmd)
           end
         else
           converge_by("create firewall rule #{new_resource.rule_name}") do
             cmd = firewall_command("New")
-            powershell_out!(cmd)
+            powershell_exec!(cmd)
           end
         end
       end
@@ -212,7 +212,7 @@ class Chef
 
         if current_resource
           converge_by("delete firewall rule #{new_resource.rule_name}") do
-            powershell_out!("Remove-NetFirewallRule -Name '#{new_resource.rule_name}'")
+            powershell_exec!("Remove-NetFirewallRule -Name '#{new_resource.rule_name}'")
           end
         else
           Chef::Log.info("Firewall rule \"#{new_resource.rule_name}\" doesn't exist. Skipping.")
@@ -273,11 +273,11 @@ class Chef
           requirements.assert(:create) do |a|
             a.assertion do
               if new_resource.icmp_type.is_a?(Integer)
-                (0..255).include?(new_resource.icmp_type)
+                (0..255).cover?(new_resource.icmp_type)
               elsif new_resource.icmp_type.is_a?(String) && !new_resource.icmp_type.include?(":") && new_resource.protocol.start_with?("ICMP")
-                (0..255).include?(new_resource.icmp_type.to_i)
+                (0..255).cover?(new_resource.icmp_type.to_i)
               elsif new_resource.icmp_type.is_a?(String) && new_resource.icmp_type.include?(":") && new_resource.protocol.start_with?("ICMP")
-                new_resource.icmp_type.split(":").all? { |type| (0..255).include?(type.to_i) }
+                new_resource.icmp_type.split(":").all? { |type| (0..255).cover?(type.to_i) }
               else
                 true
               end
@@ -318,7 +318,7 @@ class Chef
             service = $serviceFilter.Service
             interface_type = $interfaceTypeFilter.InterfaceType.ToString()
             enabled = [bool]::Parse($rule.Enabled.ToString())
-          }) | ConvertTo-Json
+          })
         EOH
       end
     end

data/lib/chef/resource/windows_font.rb

@@ -21,6 +21,7 @@ class Chef
   class Resource
     class WindowsFont < Chef::Resource
       require_relative "../util/path_helper"
+      unified_mode true
 
       provides(:windows_font) { true }
 
@@ -31,7 +32,7 @@ class Chef
 
       ```ruby
       windows_font 'Custom.otf' do
-        source "https://example.com/Custom.otf"
+        source 'https://example.com/Custom.otf'
       end
       ```
       DOC
@@ -42,7 +43,7 @@ class Chef
 
       property :source, String,
         description: "A local filesystem path or URI that is used to source the font file.",
-        coerce: proc { |x| x =~ /^.:.*/ ? x.tr('\\', "/").gsub("//", "/") : x }
+        coerce: proc { |x| /^.:.*/.match?(x) ? x.tr('\\', "/").gsub("//", "/") : x }
 
       action :install do
         description "Install a font to the system fonts directory."
@@ -84,7 +85,7 @@ class Chef
 
         # install the font into the appropriate fonts directory
         def install_font
-          require "win32ole" if RUBY_PLATFORM =~ /mswin|mingw32|windows/
+          require "win32ole" if RUBY_PLATFORM.match?(/mswin|mingw32|windows/)
           fonts_dir = Chef::Util::PathHelper.join(ENV["windir"], "fonts")
           folder = WIN32OLE.new("Shell.Application").Namespace(fonts_dir)
           converge_by("install font #{new_resource.font_name} to #{fonts_dir}") do
@@ -96,10 +97,11 @@ class Chef
         #
         # @return [Boolean] Is the font is installed?
         def font_exists?
-          require "win32ole" if RUBY_PLATFORM =~ /mswin|mingw32|windows/
+          require "win32ole" if RUBY_PLATFORM.match?(/mswin|mingw32|windows/)
           fonts_dir = WIN32OLE.new("WScript.Shell").SpecialFolders("Fonts")
+          fonts_dir_local = Chef::Util::PathHelper.join(ENV["home"], "AppData/Local/Microsoft/Windows/fonts")
           logger.trace("Seeing if the font at #{Chef::Util::PathHelper.join(fonts_dir, new_resource.font_name)} exists")
-          ::File.exist?(Chef::Util::PathHelper.join(fonts_dir, new_resource.font_name))
+          ::File.exist?(Chef::Util::PathHelper.join(fonts_dir, new_resource.font_name)) || ::File.exist?(Chef::Util::PathHelper.join(fonts_dir_local, new_resource.font_name))
         end
 
         # Parse out the schema provided to us to see if it's one we support via remote_file.

data/lib/chef/resource/windows_package.rb

@@ -19,18 +19,42 @@
 require_relative "../mixin/uris"
 require_relative "package"
 require_relative "../provider/package/windows"
-require_relative "../win32/error" if RUBY_PLATFORM =~ /mswin|mingw|windows/
-require_relative "../dist"
+require_relative "../win32/error" if RUBY_PLATFORM.match?(/mswin|mingw|windows/)
+require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 
 class Chef
   class Resource
     class WindowsPackage < Chef::Resource::Package
       include Chef::Mixin::Uris
+      unified_mode true
 
       provides(:windows_package) { true }
       provides :package, os: "windows"
 
-      description "Use the **windows_package** resource to manage packages on the Microsoft Windows platform. The windows_package resource supports these installer formats:\n\n Microsoft Installer Package (MSI)\n Nullsoft Scriptable Install System (NSIS)\n Inno Setup (inno)\n Wise\n InstallShield\n Custom installers such as installing a non-.msi file that embeds an .msi-based installer\n"
+      description <<~DESC
+        Use the **windows_package** resource to manage packages on the Microsoft Windows platform.
+        The **windows_package** resource supports these installer formats:
+          * Microsoft Installer Package (MSI)
+          * Nullsoft Scriptable Install System (NSIS)
+          * Inno Setup (inno)
+          * Wise
+          * InstallShield
+          * Custom installers such as installing a non-.msi file that embeds an .msi-based installer
+
+        To enable idempotence of the `:install` action or to enable the `:remove` action with no source property specified,
+        `package_name` MUST be an exact match of the name used by the package installer. The names of installed packages
+        Windows knows about can be found in **Add/Remove programs**, in the output of `ohai packages`, or in the
+        `DisplayName` property in one of the following in the Windows registry:
+
+        * `HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall`
+        * `HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall`
+        * `HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall`
+
+        Note: If there are multiple versions of a package installed with the same display name, all of those packages will
+        be removed unless a version is provided in the **version** property or unless it can be discovered in the installer
+        file specified by the **source** property.
+      DESC
+
       introduced "11.12"
       examples <<~DOC
       **Install a package**:
@@ -135,15 +159,15 @@ class Chef
           end
         end),
         default_description: "The resource block's name", # this property is basically a name_property but not really so we need to spell it out
-        description: "The path to a package in the local file system. The location of the package may be at a URL."
+        description: "The path to a package in the local file system or the URL of a remote file that will be downloaded."
 
       property :checksum, String,
         desired_state: false, coerce: (proc { |c| c.downcase }),
-        description: "The SHA-256 checksum of the file. Use to prevent a file from being re-downloaded. When the local file matches the checksum, #{Chef::Dist::PRODUCT} does not download it. Use when a URL is specified by the `source` property."
+        description: "The SHA-256 checksum of the file. Use to prevent a file from being re-downloaded. When the local file matches the checksum, #{ChefUtils::Dist::Infra::PRODUCT} does not download it. Use when a URL is specified by the `source` property."
 
       property :remote_file_attributes, Hash,
         desired_state: false,
-        description: "If the source package to install is at a remote location this property allows you to define a hash of properties and their value which will be used by the underlying remote_file resource, which fetches the source."
+        description: "If the source package to install is at a remote location, this property allows you to define a hash of properties which will be used by the underlying **remote_file** resource used to fetch the source."
     end
   end
 end

data/lib/chef/resource/windows_pagefile.rb

@@ -20,6 +20,8 @@ require_relative "../resource"
 class Chef
   class Resource
     class WindowsPagefile < Chef::Resource
+      unified_mode true
+
       provides(:windows_pagefile) { true }
 
       description "Use the **windows_pagefile** resource to configure pagefile settings on Windows."
@@ -109,11 +111,13 @@ class Chef
       end
 
       action_class do
+        private
+
         # make sure the provided name property matches the appropriate format
         # we do this here and not in the property itself because if automatic_managed
         # is set then this validation is not necessary / doesn't make sense at all
         def validate_name
-          return if /^.:.*.sys/ =~ new_resource.path
+          return if /^.:.*.sys/.match?(new_resource.path)
 
           raise "#{new_resource.path} does not match the format DRIVE:\\path\\file.sys for pagefiles. Example: C:\\pagefile.sys"
         end

data/lib/chef/resource/windows_path.rb

@@ -16,11 +16,15 @@
 # limitations under the License.
 #
 
+require_relative "../mixin/windows_env_helper" if ChefUtils.windows?
+require_relative "../mixin/wide_string"
 require_relative "../resource"
 
 class Chef
   class Resource
     class WindowsPath < Chef::Resource
+      unified_mode true
+
       provides(:windows_path) { true }
 
       description "Use the **windows_path** resource to manage the path environment variable on Microsoft Windows."
@@ -49,6 +53,40 @@ class Chef
       property :path, String,
         description: "An optional property to set the path value if it differs from the resource block's name.",
         name_property: true
+
+      action_class do
+        include Chef::Mixin::WindowsEnvHelper if ChefUtils.windows?
+
+        def load_current_resource
+          @current_resource = Chef::Resource::WindowsPath.new(new_resource.name)
+          @current_resource.path(new_resource.path)
+          @current_resource
+        end
+      end
+
+      action :add do
+        # The windows Env provider does not correctly expand variables in
+        # the PATH environment variable. Ruby expects these to be expanded.
+        #
+        path = expand_path(new_resource.path)
+        env "path" do
+          action :modify
+          delim ::File::PATH_SEPARATOR
+          value path.tr("/", '\\')
+        end
+      end
+
+      action :remove do
+        # The windows Env provider does not correctly expand variables in
+        # the PATH environment variable. Ruby expects these to be expanded.
+        #
+        path = expand_path(new_resource.path)
+        env "path" do
+          action :delete
+          delim ::File::PATH_SEPARATOR
+          value path.tr("/", '\\')
+        end
+      end
     end
   end
 end

data/lib/chef/resource/windows_printer.rb

@@ -22,7 +22,9 @@ require_relative "../resource"
 class Chef
   class Resource
     class WindowsPrinter < Chef::Resource
-      require "resolv"
+      unified_mode true
+
+      autoload :Resolv, "resolv"
 
       provides(:windows_printer) { true }
 
@@ -76,34 +78,22 @@ class Chef
 
       property :ipv4_address, String,
         description: "The IPv4 address of the printer, such as `10.4.64.23`",
-        validation_message: "The ipv4_address property must be in the IPv4 format of `WWW.XXX.YYY.ZZZ`",
-        regex: Resolv::IPv4::Regex
-
-      property :exists, [TrueClass, FalseClass],
-        skip_docs: true
+        callbacks: {
+          "The ipv4_address property must be in the IPv4 format of `WWW.XXX.YYY.ZZZ`" =>
+            proc { |v| v.match(Resolv::IPv4::Regex) },
+        }
 
       PRINTERS_REG_KEY = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\\'.freeze unless defined?(PRINTERS_REG_KEY)
 
-      # does the printer exist
-      #
-      # @param [String] name the name of the printer
-      # @return [Boolean]
-      def printer_exists?(name)
-        printer_reg_key = PRINTERS_REG_KEY + name
-        logger.trace "Checking to see if this reg key exists: '#{printer_reg_key}'"
-        registry_key_exists?(printer_reg_key)
-      end
-
       # @todo Set @current_resource printer properties from registry
       load_current_value do |desired|
         name desired.name
-        exists printer_exists?(desired.name)
       end
 
       action :create do
         description "Create a new printer and a printer port if one doesn't already exist."
 
-        if @current_resource.exists
+        if printer_exists?
           Chef::Log.info "#{@new_resource} already exists - nothing to do."
         else
           converge_by("Create #{@new_resource}") do
@@ -115,7 +105,7 @@ class Chef
       action :delete do
         description "Delete an existing printer. Note this does not delete the associated printer port."
 
-        if @current_resource.exists
+        if printer_exists?
           converge_by("Delete #{@new_resource}") do
             delete_printer
           end
@@ -125,11 +115,22 @@ class Chef
       end
 
       action_class do
+        private
+
+        # does the printer exist
+        #
+        # @param [String] name the name of the printer
+        # @return [Boolean]
+        def printer_exists?
+          printer_reg_key = PRINTERS_REG_KEY + new_resource.name
+          logger.trace "Checking to see if this reg key exists: '#{printer_reg_key}'"
+          registry_key_exists?(printer_reg_key)
+        end
+
         # creates the printer port and then the printer
         def create_printer
           # Create the printer port first
-          windows_printer_port new_resource.ipv4_address do
-          end
+          windows_printer_port new_resource.ipv4_address
 
           port_name = "IP_#{new_resource.ipv4_address}"
 

data/lib/chef/resource/windows_printer_port.rb

@@ -22,7 +22,9 @@ require_relative "../resource"
 class Chef
   class Resource
     class WindowsPrinterPort < Chef::Resource
-      require "resolv"
+      unified_mode true
+
+      autoload :Resolv, "resolv"
 
       provides(:windows_printer_port) { true }
 
@@ -59,9 +61,11 @@ class Chef
 
       property :ipv4_address, String,
         name_property: true,
-        regex: Resolv::IPv4::Regex,
-        validation_message: "The ipv4_address property must be in the format of WWW.XXX.YYY.ZZZ!",
-        description: "An optional property for the IPv4 address of the printer if it differs from the resource block's name."
+        description: "An optional property for the IPv4 address of the printer if it differs from the resource block's name.",
+        callbacks: {
+          "The ipv4_address property must be in the format of WWW.XXX.YYY.ZZZ!" =>
+            proc { |v| v.match(Resolv::IPv4::Regex) },
+        }
 
       property :port_name, String,
         description: "The port name."
@@ -82,30 +86,19 @@ class Chef
         validation_message: "port_protocol must be either 1 for RAW or 2 for LPR!",
         default: 1, equal_to: [1, 2]
 
-      property :exists, [TrueClass, FalseClass],
-        skip_docs: true
-
       PORTS_REG_KEY = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\\'.freeze unless defined?(PORTS_REG_KEY)
 
-      def port_exists?(name)
-        port_reg_key = PORTS_REG_KEY + name
-
-        logger.trace "Checking to see if this reg key exists: '#{port_reg_key}'"
-        registry_key_exists?(port_reg_key)
-      end
-
       # @todo Set @current_resource port properties from registry
       load_current_value do |desired|
         name desired.name
         ipv4_address desired.ipv4_address
         port_name desired.port_name || "IP_#{desired.ipv4_address}"
-        exists port_exists?(desired.port_name || "IP_#{desired.ipv4_address}")
       end
 
       action :create do
         description "Create the new printer port if it does not already exist."
 
-        if current_resource.exists
+        if port_exists?
           Chef::Log.info "#{@new_resource} already exists - nothing to do."
         else
           converge_by("Create #{@new_resource}") do
@@ -117,7 +110,7 @@ class Chef
       action :delete do
         description "Delete an existing printer port."
 
-        if current_resource.exists
+        if port_exists?
           converge_by("Delete #{@new_resource}") do
             delete_printer_port
           end
@@ -127,6 +120,16 @@ class Chef
       end
 
       action_class do
+        private
+
+        def port_exists?
+          name = new_resource.port_name || "IP_#{new_resource.ipv4_address}"
+          port_reg_key = PORTS_REG_KEY + name
+
+          logger.trace "Checking to see if this reg key exists: '#{port_reg_key}'"
+          registry_key_exists?(port_reg_key)
+        end
+
         def create_printer_port
           port_name = new_resource.port_name || "IP_#{new_resource.ipv4_address}"
 

data/lib/chef/resource/windows_script.rb

@@ -16,34 +16,20 @@
 # limitations under the License.
 #
 
-require_relative "../platform/query_helpers"
 require_relative "script"
 require_relative "../mixin/windows_architecture_helper"
 
 class Chef
   class Resource
     class WindowsScript < Chef::Resource::Script
-      unified_mode true
+      include Chef::Mixin::WindowsArchitectureHelper
 
-      provides :windows_script
+      unified_mode true
 
       # This is an abstract resource meant to be subclasses; thus no 'provides'
 
       set_guard_inherited_attributes(:architecture)
 
-      protected
-
-      def initialize(name, run_context, resource_name, interpreter_command)
-        super(name, run_context)
-        @interpreter = interpreter_command
-        @resource_name = resource_name if resource_name
-        @default_guard_interpreter = self.resource_name
-      end
-
-      include Chef::Mixin::WindowsArchitectureHelper
-
-      public
-
       def architecture(arg = nil)
         assert_architecture_compatible!(arg) unless arg.nil?
         result = set_or_return(

data/lib/chef/resource/windows_security_policy.rb

@@ -17,29 +17,37 @@
 # limitations under the License.
 
 require_relative "../resource"
+require "tempfile" unless defined?(Tempfile)
 
 class Chef
   class Resource
     class WindowsSecurityPolicy < Chef::Resource
-      resource_name :windows_security_policy
+      unified_mode true
+
+      provides :windows_security_policy
 
       # The valid policy_names options found here
       # https://github.com/ChrisAWalker/cSecurityOptions under 'AccountSettings'
-      policy_names = %w{MinimumPasswordAge
-                MaximumPasswordAge
-                MinimumPasswordLength
-                PasswordComplexity
-                PasswordHistorySize
-                LockoutBadCount
-                RequireLogonToChangePassword
-                ForceLogoffWhenHourExpire
-                NewAdministratorName
-                NewGuestName
-                ClearTextPassword
-                LSAAnonymousNameLookup
-                EnableAdminAccount
-                EnableGuestAccount
-                }
+      # This needs to be revisited - the list at the link above is non-exhaustive and is missing a couple of items
+      policy_names = %w{LockoutDuration
+                        MaximumPasswordAge
+                        MinimumPasswordAge
+                        MinimumPasswordLength
+                        PasswordComplexity
+                        PasswordHistorySize
+                        LockoutBadCount
+                        ResetLockoutCount
+                        AuditPolicyChange
+                        LockoutDuration
+                        RequireLogonToChangePassword
+                        ForceLogoffWhenHourExpire
+                        NewAdministratorName
+                        NewGuestName
+                        ClearTextPassword
+                        LSAAnonymousNameLookup
+                        EnableAdminAccount
+                        EnableGuestAccount
+                      }
       description "Use the **windows_security_policy** resource to set a security policy on the Microsoft Windows platform."
       introduced "16.0"
 
@@ -78,42 +86,83 @@ class Chef
       property :secvalue, String, required: true,
       description: "Policy value to be set for policy name."
 
+      load_current_value do |desired|
+        current_state = load_security_options
+
+        if desired.secoption == "ResetLockoutCount"
+          if desired.secvalue.to_i > 30
+            raise Chef::Exceptions::ValidationFailed, "The \"ResetLockoutCount\" value cannot be greater than 30 minutes"
+          end
+        end
+        if (desired.secoption == "ResetLockoutCount" || desired.secoption == "LockoutDuration") && current_state["LockoutBadCount"] == "0"
+          raise Chef::Exceptions::ValidationFailed, "#{desired.secoption} cannot be set unless the \"LockoutBadCount\" security policy has been set to a non-zero value"
+        end
+
+        secvalue current_state[desired.secoption.to_s]
+      end
+
       action :set do
-        security_option = new_resource.secoption
-        security_value = new_resource.secvalue
-        powershell_script "#{security_option} set to #{security_value}" do
-          convert_boolean_return true
-          code <<-EOH
-            $security_option = "#{security_option}"
-            if ( ($security_option -match "NewGuestName") -Or ($security_option -match "NewAdministratorName") )
-              {
-                $#{security_option}_Remediation = (Get-Content $env:TEMP\\#{security_option}_Export.inf) | Foreach-Object { $_ -replace '#{security_option}\\s*=\\s*\\"\\w*\\"', '#{security_option} = "#{security_value}"' } | Set-Content $env:TEMP\\#{security_option}_Export.inf
-                C:\\Windows\\System32\\secedit /configure /db $env:windir\\security\\new.sdb /cfg $env:TEMP\\#{security_option}_Export.inf /areas SECURITYPOLICY
-              }
-            else
-              {
-                $#{security_option}_Remediation = (Get-Content $env:TEMP\\#{security_option}_Export.inf) | Foreach-Object { $_ -replace "#{security_option}\\s*=\\s*\\d*", "#{security_option} = #{security_value}" } | Set-Content $env:TEMP\\#{security_option}_Export.inf
-                C:\\Windows\\System32\\secedit /configure /db $env:windir\\security\\new.sdb /cfg $env:TEMP\\#{security_option}_Export.inf /areas SECURITYPOLICY
-              }
-            Remove-Item $env:TEMP\\#{security_option}_Export.inf -force
-          EOH
-          not_if <<-EOH
-            $#{security_option}_Export = C:\\Windows\\System32\\secedit /export /cfg $env:TEMP\\#{security_option}_Export.inf
-            $ExportAudit = (Get-Content $env:TEMP\\#{security_option}_Export.inf | Select-String -Pattern #{security_option})
-            $check_digit = $ExportAudit -match '#{security_option} = #{security_value}'
-            $check_string = $ExportAudit -match '#{security_option} = "#{security_value}"'
-            if ( $check_string -Or $check_digit )
-              {
-                Remove-Item $env:TEMP\\#{security_option}_Export.inf -force
-                $true
-              }
-            else
-              {
-                $false
-              }
-          EOH
+        converge_if_changed :secvalue do
+          security_option = new_resource.secoption
+          security_value = new_resource.secvalue
+
+          file = Tempfile.new(["#{security_option}", ".inf"])
+          case security_option
+          when "LockoutBadCount"
+            cmd = "net accounts /LockoutThreshold:#{security_value}"
+          when "ResetLockoutCount"
+            cmd = "net accounts /LockoutWindow:#{security_value}"
+          when "LockoutDuration"
+            cmd = "net accounts /LockoutDuration:#{security_value}"
+          when "NewAdministratorName", "NewGuestName"
+            policy_line = "#{security_option} = \"#{security_value}\""
+            file.write("[Unicode]\r\nUnicode=yes\r\n[System Access]\r\n#{policy_line}\r\n[Version]\r\nsignature=\"$CHICAGO$\"\r\nRevision=1\r\n")
+            file.close
+            file_path = file.path.gsub("/", '\\')
+            cmd = "C:\\Windows\\System32\\secedit /configure /db C:\\windows\\security\\new.sdb /cfg #{file_path} /areas SECURITYPOLICY"
+          else
+            policy_line = "#{security_option} = #{security_value}"
+            file.write("[Unicode]\r\nUnicode=yes\r\n[System Access]\r\n#{policy_line}\r\n[Version]\r\nsignature=\"$CHICAGO$\"\r\nRevision=1\r\n")
+            file.close
+            file_path = file.path.gsub("/", '\\')
+            cmd = "C:\\Windows\\System32\\secedit /configure /db C:\\windows\\security\\new.sdb /cfg #{file_path} /areas SECURITYPOLICY"
+          end
+          shell_out!(cmd)
+          file.unlink
         end
       end
+
+      private
+
+      # Loads powershell to get current state on security options
+      def load_security_options
+        powershell_code = <<-CODE
+          C:\\Windows\\System32\\secedit /export /cfg $env:TEMP\\secopts_export.inf | Out-Null
+          # cspell:disable-next-line
+          $security_options_data = (Get-Content $env:TEMP\\secopts_export.inf | Select-String -Pattern "^[CEFLMNPR].* =.*$" | Out-String)
+          Remove-Item $env:TEMP\\secopts_export.inf -force
+          $security_options_hash = ($security_options_data -Replace '"'| ConvertFrom-StringData)
+          ([PSCustomObject]@{
+            RequireLogonToChangePassword = $security_options_hash.RequireLogonToChangePassword
+            PasswordComplexity = $security_options_hash.PasswordComplexity
+            LSAAnonymousNameLookup = $security_options_hash.LSAAnonymousNameLookup
+            EnableAdminAccount = $security_options_hash.EnableAdminAccount
+            PasswordHistorySize = $security_options_hash.PasswordHistorySize
+            MinimumPasswordLength = $security_options_hash.MinimumPasswordLength
+            ResetLockoutCount = $security_options_hash.ResetLockoutCount
+            MaximumPasswordAge = $security_options_hash.MaximumPasswordAge
+            ClearTextPassword = $security_options_hash.ClearTextPassword
+            NewAdministratorName = $security_options_hash.NewAdministratorName
+            LockoutDuration = $security_options_hash.LockoutDuration
+            EnableGuestAccount = $security_options_hash.EnableGuestAccount
+            ForceLogoffWhenHourExpire = $security_options_hash.ForceLogoffWhenHourExpire
+            MinimumPasswordAge = $security_options_hash.MinimumPasswordAge
+            NewGuestName = $security_options_hash.NewGuestName
+            LockoutBadCount = $security_options_hash.LockoutBadCount
+          })
+        CODE
+        powershell_exec(powershell_code).result
+      end
     end
   end
 end