Pin sid_spec default group expectation to observed behavior

3 files changed, 8 insertions, 3 deletions

diff --git a/lib/chef/win32/security/sid.rb b/lib/chef/win32/security/sid.rb
index 7f461fd766..f8bd934876 100644
--- a/lib/chef/win32/security/sid.rb
+++ b/lib/chef/win32/security/sid.rb
@@ -213,7 +213,8 @@ class Chef
         end
 
         # See https://technet.microsoft.com/en-us/library/cc961996.aspx
-        # In practice, this is generally the same as current_user
+        # In practice, this seems to be SID.current_user for Microsoft Accounts, the current
+        # user's Domain Users group for domain accounts, and SID.None otherwise.
         def self.default_security_object_group
           token = Chef::ReservedNames::Win32::Security.open_current_process_token
           Chef::ReservedNames::Win32::Security.get_token_information_primary_group(token)
diff --git a/spec/functional/win32/sid_spec.rb b/spec/functional/win32/sid_spec.rb
index a12cfb6e79..1f5f66178a 100644
--- a/spec/functional/win32/sid_spec.rb
+++ b/spec/functional/win32/sid_spec.rb
@@ -26,8 +26,11 @@ describe 'Chef::ReservedNames::Win32::SID', :windows_only do
     SID ||= Chef::ReservedNames::Win32::Security::SID
   end
 
-  it 'should resolve default_security_object_group as the current user' do
-    expect(SID.default_security_object_group).to eq(SID.current_user)
+  it 'should resolve default_security_object_group as a sane user group', :windows_not_domain_joined_only do
+    # Domain accounts: domain-specific Domain Users SID
+    # Microsoft Accounts: SID.current_user
+    # Else: SID.None
+    expect(SID.default_security_object_group).to eq(SID.None).or eq(SID.current_user)
   end
 
   context 'running as an elevated administrator user' do
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index fb284c721b..775b49c145 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -126,6 +126,7 @@ RSpec.configure do |config|
   config.filter_run_excluding :windows_powershell_dsc_only => true unless windows_powershell_dsc?
   config.filter_run_excluding :windows_powershell_no_dsc_only => true unless ! windows_powershell_dsc?
   config.filter_run_excluding :windows_domain_joined_only => true unless windows_domain_joined?
+  config.filter_run_excluding :windows_not_domain_joined_only => true if windows_domain_joined?
   config.filter_run_excluding :solaris_only => true unless solaris?
   config.filter_run_excluding :system_windows_service_gem_only => true unless system_windows_service_gem?
   config.filter_run_excluding :unix_only => true unless unix?