Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AADPasswordRuleSettings - Drift is detected but settings do not apply. #5784

Open
Stubick opened this issue Feb 15, 2025 · 0 comments
Open

Comments

@Stubick
Copy link

Stubick commented Feb 15, 2025

Description of the issue

When running a configuration to apply AADPasswordRuleSettings I input some custom banned passwords these are detected in the drift but they are not applied manually or by the LCM when in ApplyAndAutoCorrect mode.

Microsoft 365 DSC Version

1.25.212.2

Which workloads are affected

Azure Active Directory (Entra ID)

The DSC configuration

# Generated with Microsoft365DSC version 1.25.212.2
# For additional information on how to use Microsoft365DSC, please visit https://aka.ms/M365DSC
param (
    [parameter()]
    [System.Management.Automation.PSCredential]
    $Credential
)

Configuration M365TenantConfig
{
    param (
        [parameter()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    if ($null -eq $Credential)
    {
        <# Credentials #>
        $Credscredential = Get-Credential -Message "Credentials"

    }
    else
    {
        $CredsCredential = $Credential
    }

    $OrganizationName = $CredsCredential.UserName.Split('@')[1]

    Import-DscResource -ModuleName 'Microsoft365DSC' -ModuleVersion '1.25.212.2'

    Node localhost
    {
        AADPasswordRuleSettings "AADPasswordRuleSettings"
        {
            BannedPasswordCheckOnPremisesMode   = "Audit";
            BannedPasswordList                  = @("Test","Jefte1234","Secondtest","Password");
            Credential                          = $Credscredential;
            EnableBannedPasswordCheck           = $True;
            EnableBannedPasswordCheckOnPremises = $false;
            Ensure                              = "Present";
            IsSingleInstance                    = "Yes";
            LockoutDurationInSeconds            = "120";
            LockoutThreshold                    = "5";
        }
    }
}

M365TenantConfig -ConfigurationData .\ConfigurationData.psd1 -Credential $Credential

Verbose logs showing the problem

<M365DSCEvent>
    <ConfigurationDrift Source="MSFT_AADPasswordRuleSettings" TenantId="Omitted">
        <ParametersNotInDesiredState>
            <Param Name="BannedPasswordList"><CurrentValue>Test Notatest</CurrentValue><DesiredValue>Test Jefte1234 Secondtest Password</DesiredValue></Param>
        </ParametersNotInDesiredState>
    </ConfigurationDrift>
    <DesiredValues>
        <Param Name ="IsSingleInstance">Yes</Param>
        <Param Name ="LockoutThreshold">5</Param>
        <Param Name ="LockoutDurationInSeconds">120</Param>
        <Param Name ="EnableBannedPasswordCheck">True</Param>
        <Param Name ="BannedPasswordList">Test Jefte1234 Secondtest Password</Param>
        <Param Name ="BannedPasswordCheckOnPremisesMode">Audit</Param>
        <Param Name ="EnableBannedPasswordCheckOnPremises">False</Param>
        <Param Name ="Ensure">Present</Param>
        <Param Name ="Credential">System.Management.Automation.PSCredential</Param>
        <Param Name ="Verbose">True</Param>
    </DesiredValues>
    <CurrentValues>
        <Param Name ="ApplicationSecret">$null</Param>
        <Param Name ="ApplicationId">$null</Param>
        <Param Name ="EnableBannedPasswordCheck">True</Param>
        <Param Name ="AccessTokens">$null</Param>
        <Param Name ="CertificateThumbprint">$null</Param>
        <Param Name ="Credential">System.Management.Automation.PSCredential</Param>
        <Param Name ="Managedidentity">False</Param>
        <Param Name ="LockoutThreshold">5</Param>
        <Param Name ="EnableBannedPasswordCheckOnPremises">False</Param>
        <Param Name ="Ensure">Present</Param>
        <Param Name ="TenantId">$null</Param>
        <Param Name ="IsSingleInstance">Yes</Param>
        <Param Name ="BannedPasswordList">Test Notatest</Param>
        <Param Name ="LockoutDurationInSeconds">120</Param>
        <Param Name ="BannedPasswordCheckOnPremisesMode">Audit</Param>
    </CurrentValues>
</M365DSCEvent>

Environment Information + PowerShell Version

OsName               : Microsoft Windows 10 Enterprise
OsOperatingSystemSKU : EnterpriseEdition
OsArchitecture       : 64-bit
WindowsVersion       : 2009
WindowsBuildLabEx    : 19041.1.amd64fre.vb_release.191206-1406
OsLanguage           : en-GB
OsMuiLanguages       : {en-GB}

Key   : PSVersion
Value : 5.1.19041.5486
Name  : PSVersion

Key   : PSEdition
Value : Desktop
Name  : PSEdition

Key   : PSCompatibleVersions
Value : {1.0, 2.0, 3.0, 4.0...}
Name  : PSCompatibleVersions

Key   : BuildVersion
Value : 10.0.19041.5486
Name  : BuildVersion

Key   : CLRVersion
Value : 4.0.30319.42000
Name  : CLRVersion

Key   : WSManStackVersion
Value : 3.0
Name  : WSManStackVersion

Key   : PSRemotingProtocolVersion
Value : 2.3
Name  : PSRemotingProtocolVersion

Key   : SerializationVersion
Value : 1.1.0.1
Name  : SerializationVersion
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant