security_identifier resource

Use the security_identifier Chef InSpec resource to test the Security Identifier (SID) for user and group trustees on Windows.

Availability

This resource is distributed along with Chef InSpec itself. You can use it automatically.

A security_identifier resource should specify the name and type of the trustee to test the SID for:

describe security_identifier(group: 'Everyone') do
  its('sid') { should eq 'S-1-1-0' }
end

where

group: specifies that 'Everyone' should be a group. user: can be used to specify a user account. ** It is necessary to declare the type of the trustee because Windows allows users, groups and other entities to share names. If you really need to not specify the type, unspecified: can be used. This will attempt to match the name to a group and then a useraccount. This may take longer to execute and comes with the risk of Chef InSpec matching the name to an unintended trustee.

The following examples show how to use this Chef InSpec resource.

describe security_identifier(user: 'Administrator') do
  it { should exist }
end

describe security_identifier(group: 'Everyone') do
  its('sid') { should eq 'S-1-1-0' }
end

describe security_policy do
  its("SeRemoteInteractiveLogonRight") { should_not include security_identifier(group: 'Guests') }
end

describe security_identifier(group: 'Everyone') do
  its('sid') { should eq 'S-1-1-0' }
end

This Chef InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our matchers page.

For this resource, exist is true if a Security Identifier (SID) exists on the target host for the specified trustee.