Implemented a GPO check to prevent an endless reboot loop when CredSSP is configured via a GPO

Author: matt6697

lib/facter/credsspclientgpo.rb

@@ -0,0 +1,17 @@
+#https://puppet.com/blog/starting-out-writing-custom-facts-windows
+Facter.add('credsspclientgpo') do
+  confine :osfamily => :windows
+  setcode do
+    begin
+      result=false
+      value = nil
+      Win32::Registry::HKEY_LOCAL_MACHINE.open('SOFTWARE\Policies\Microsoft\Windows\WinRM\Client') do |regkey|
+        value = regkey['AllowCredSSP']
+        result=true
+      end
+      result
+    rescue
+      false
+    end
+  end
+end

lib/facter/credsspservicegpo.rb

@@ -0,0 +1,17 @@
+#https://puppet.com/blog/starting-out-writing-custom-facts-windows
+Facter.add('credsspservicegpo') do
+  confine :osfamily => :windows
+  setcode do
+    begin
+      result=false
+      value = nil
+      Win32::Registry::HKEY_LOCAL_MACHINE.open('SOFTWARE\Policies\Microsoft\Windows\WinRM\Service') do |regkey|
+        value = regkey['AllowCredSSP']
+        result=true
+      end
+      result
+    rescue
+      false
+    end
+  end
+end

manifests/install.pp

@@ -5,16 +5,32 @@
 	 when => refreshed
 	}
 
-	dsc_xcredssp{ 'Server':
-	 dsc_ensure => 'Present',
-	 dsc_role => 'Server',
-	 notify => Reboot['after_run']
+	#Implemented a GPO check to prevent an endless reboot loop when CredSSP is configured via a GPO
+	if (!$credsspservicegpo) {
+		dsc_xcredssp{ 'Server':
+		 dsc_ensure => 'Present',
+		 dsc_role => 'Server',
+		 notify => Reboot['after_run']
+		}
+	}
+	else {
+		notify { 'CredSSPServic#Implemented a GPO check to prevent an endless reboot loop when CredSSP is configured via a GPOeAlreadyConfigured':
+			message => 'CredSSP already configured by GPO. Unauthorized to overide GPO configuration. Please check that CredSSP service is allowed on this Computer.'
+		}
 	}
 
-	dsc_xcredssp{ 'Client':
-	 dsc_ensure => 'Present',
-	 dsc_role => 'Client',
-	 dsc_delegatecomputers => '*'
+	#Implemented a GPO check to prevent an endless reboot loop when CredSSP is configured via a GPO
+	if (!$credsspclientgpo) {
+		dsc_xcredssp{ 'Client':
+		 dsc_ensure => 'Present',
+		 dsc_role => 'Client',
+		 dsc_delegatecomputers => '*'
+		}
+	}
+	else {
+		notify { 'CredSSPClientAlreadyConfigured':
+			message => 'CredSSP already configured by GPO. Unauthorized to overide GPO configuration. Please check that CredSSP client is allowed on this Computer.'
+		}
 	}
 
 	#Ensure IIS is not installed on the system to avoid conflicts with Broker Service