exec power shell script having corrective action every time

Question

Getting the corrective action for exec while using Powershell to ADD usersand groups to local admin group. Please note I am not a scripting guy, not sure what wrong I am doing.

Notice: /

Answer 1

By default, an Exec resource is applied on every run. That is mediated, where desired, by the resource's unless, onlyif, and / or creates parameters, as described in that resource type's documentation.

The creates parameter is probably not appropriate for this particular case, so choose one of unless or onlyif. Each one is expected to specify a command for Puppet to run, whose success or failure (as judged by its exit status) determines whether the Exec should be applied. These two parameters differ primarily in how they interpret the exit status:

• unless interprets exit status 0 (success) as indicating that the Exec's main command should not be run

• onlyif interprets exit statuses other than 0 (success) as indicating that the Exec's main command should not be run

I cannot advise you about the specific command to use here, but the general form of the resource declaration would be:

exec { 'Add-LocalGroupMember Administrators built-in':
  command  => '... PowerShell command to do the work ...',
  unless   => '... PowerShell command that exits with status 0 if the work is already done ...',
  provider => 'powershell',
}

(That assumes that the puppetlabs-powershell module is installed, which I take to be the case for you based on details presented in the question.)

I see your comment on the question claiming that you tried this approach without success, but this is the answer. If your attempts to implement this were unsuccessful then you'll need to look more deeply into what went wrong with those. You haven't presented any of those details, and I'm anyway not fluent in PowerShell, but my first guess would be that the exit status of your unless or onlyif script was computed wrongly.

Additionally, you probably should set the Exec's refresh property to a command that succeeds without doing anything. I'm not sure what the would be on Windows, but on most other systems that Puppet supports, /bin/true would be idiomatic. (That's not correct for Windows; I give it only as an example of the kind of thing I mean.) This will prevent running the main command twice in the same Puppet run in the event that the Exec receives an event.