updates user search verification for local/domain

- Thanks to @trondhindenes for implementing this strategy
- also updated documentation

windows/win_acl.ps1

@@ -20,6 +20,67 @@
 # POWERSHELL_COMMON
  
 # win_acl module (File/Resources Permission Additions/Removal)
+ 
+ 
+#Functions
+Function UserSearch
+{
+    Param ([string]$AccountName)
+    #Check if there's a realm specified
+    if ($AccountName.Split("\").count -gt 1)
+    {
+        if ($AccountName.Split("\")[0] -eq $env:COMPUTERNAME)
+        {
+            $IsLocalAccount = $true
+        }
+        Else
+        {
+            $IsDomainAccount = $true
+            $IsUpn = $false
+        }
+ 
+    }
+    Elseif ($AccountName -contains "@")
+    {
+        $IsDomainAccount = $true
+        $IsUpn = $true
+    }
+    Else
+    {
+        #Default to local user account
+        $accountname = $env:COMPUTERNAME + "\" + $AccountName
+        $IsLocalAccount = $true
+    }
+ 
+ 
+    if ($IsLocalAccount -eq $true)
+    {
+        $localaccount = get-wmiobject -class "Win32_UserAccount" -namespace "root\CIMV2" -filter "(LocalAccount = True)" | where {$_.Caption -eq $AccountName}
+        if ($localaccount)
+        {
+            return $localaccount.Caption
+        }
+        $LocalGroup = get-wmiobject -class "Win32_Group" -namespace "root\CIMV2" -filter "LocalAccount = True"| where {$_.Caption -eq $AccountName}
+        if ($LocalGroup)
+        {
+            return $LocalGroup.Caption
+        }
+    }
+    ElseIf (($IsDomainAccount -eq $true) -and ($IsUpn -eq $false))
+    {
+        #Search by samaccountname
+        $Searcher = [adsisearcher]""
+        $Searcher.Filter = "sAMAccountName=$($accountname.split("\")[1])"
+        $result = $Searcher.FindOne()
+ 
+        if ($result)
+        {
+            return $accountname
+        }
+    }
+ 
+}
+ 
 $params = Parse-Args $args;
  
 $result = New-Object psobject @{
@@ -39,13 +100,12 @@ Else {
 }
  
 If ($params.user) {
-    $user = $params.user.toString()
+    $user = UserSearch -AccountName ($Params.User)
  
-    # Test that the user/group exists on the local machine
+    # Test that the user/group is resolvable on the local machine
-    $localComputer = [ADSI]("WinNT://"+[System.Net.Dns]::GetHostName())
+    if (!$user)
-    $list = ($localComputer.psbase.children | Where-Object { (($_.psBase.schemaClassName -eq "User") -Or ($_.psBase.schemaClassName -eq "Group"))} | Select-Object -expand Name)
+    {
-    If (-Not ($list -contains "$user")) {
+          Fail-Json $result "$($Params.User) is not a valid user or group on the host machine or domain"
-        Fail-Json $result "$user is not a valid user or group on the host machine"
     }    
 }
 Else {

windows/win_acl.py

@@ -24,7 +24,7 @@
 DOCUMENTATION = '''
 ---
 module: win_acl
-version_added: ""
+version_added: "2.0"
 short_description: Set file/directory permissions for a system user or group.
 description:
      - Add or remove rights/permissions for a given user or group for the specified src file or folder.
@@ -107,7 +107,7 @@ options:
       - InheritOnly
     default: "None"
     aliases: []
-author: Phil Schwartz
+author: Phil Schwartz, Trond Hindenes
 '''
 
 EXAMPLES = '''