windows_group

Experimental. A local group on a Windows host, and who is in it. Settings left unset are left as they are.

Experimental. Windows support is new, and this module may change between releases.

Use windows_group to keep a local group on a Windows host and make sure the right accounts are in it. Members are compared by SID, so LAB\alice and lab\Alice are the same account.

Example usage

step "app_admins" {
  windows_group {
    name        = "AppAdmins"
    description = "Can manage the app"
    members     = ["appsvc", "LAB\\alice"]
  }
}

step "rdp_only_ops" {
  windows_group {
    name          = "Remote Desktop Users"
    members       = ["LAB\\ops"]
    authoritative = true
  }
}

Arguments

Name	Type	Required	Description
authoritative	bool	No	true makes members the complete list: anyone else is taken out. Never the login Conn3x uses.
description	string	No	Description, up to 48 characters.
members	set of string	No	Users and groups that must be in it, by name, such as LAB\alice, or by SID. Others are left in unless authoritative is set.
name	string	Yes	Group name, such as Remote Desktop Users.
on_remove	string	No	What happens on the host when this resource is removed: “forget” (default) leaves the group, “delete” deletes it.

Read-only attributes

Conn3x sets these; reference them as conn3x_windows_group.<circuit>__<step>["<host>"].<name>.

Name	Type	Description
in_sync	bool	Whether the group matched at the last refresh.
revision	string	Changes each time Conn3x changes this on the host. Handlers watch it.

A step lowers to the conn3x_windows_group resource, one instance per host, and connects with its circuit’s ssh block.

How it works

Members. By default, members are added and nobody else is taken out. With authoritative = true the list is complete: anyone else is removed on apply. In a group the login Conn3x uses belongs to, such as Administrators, Conn3x refuses to remove the login or any group it gets its rights through, such as Domain Admins, so apply fails until the list keeps them.

A member that doesn’t exist yet, such as a user a later step makes, shows the group as out of sync rather than failing the plan. At apply, a name that still doesn’t resolve is an error.

Removal

By default, deleting a windows_group step leaves the group and its members. With on_remove = "delete" it deletes the group.