diff --git a/lib/puppet/provider/file/windows.rb b/lib/puppet/provider/file/windows.rb
index dbd4c8818..d3ea9b0b7 100644
--- a/lib/puppet/provider/file/windows.rb
+++ b/lib/puppet/provider/file/windows.rb
@@ -1,79 +1,79 @@
 Puppet::Type.type(:file).provide :windows do
   desc "Uses Microsoft Windows functionality to manage file's users and rights."
 
   confine :feature => :microsoft_windows
 
   include Puppet::Util::Warnings
 
   if Puppet.features.microsoft_windows?
     require 'puppet/util/windows'
     require 'puppet/util/adsi'
     include Puppet::Util::Windows::Security
   end
 
   ERROR_INVALID_SID_STRUCTURE = 1337
 
   def uid2name(id)
     # If it's a valid sid, get the name. Otherwise, it's already a name, so
     # just return it.
     begin
       if string_to_sid_ptr(id)
         name = nil
         Puppet::Util::ADSI.execquery(
           "SELECT Name FROM Win32_Account WHERE SID = '#{id}'
            AND LocalAccount = true"
         ).each { |u| name ||= u.name }
         return name
       end
     rescue Puppet::Util::Windows::Error => e
       raise unless e.code == ERROR_INVALID_SID_STRUCTURE
     end
 
     id
   end
 
   # Determine if the user is valid, and if so, return the UID
   def name2uid(value)
     # If it's a valid sid, then return it. Else, it's name we need to convert
     # to sid.
     begin
       return value if string_to_sid_ptr(value)
     rescue Puppet::Util::Windows::Error => e
       raise unless e.code == ERROR_INVALID_SID_STRUCTURE
     end
 
-    Puppet::Util::ADSI::User.new(value).sid rescue nil
+    Puppet::Util::ADSI.sid_for_account(value) rescue nil
   end
 
   def owner
     return :absent unless resource.exist?
     get_owner(resource[:path])
   end
 
   def owner=(should)
     begin
       set_owner(should, resource[:path])
     rescue => detail
       raise Puppet::Error, "Failed to set owner to '#{should}': #{detail}"
     end
   end
 
   def mode
     if resource.exist?
       get_mode(resource[:path]).to_s(8)
     else
       :absent
     end
   end
 
   def mode=(value)
     begin
       set_mode(value.to_i(8), resource[:path])
     rescue => detail
       error = Puppet::Error.new("failed to set mode #{mode} on #{resource[:path]}: #{detail.message}")
       error.set_backtrace detail.backtrace
       raise error
     end
     :file_changed
   end
 end
diff --git a/lib/puppet/util/adsi.rb b/lib/puppet/util/adsi.rb
index 9fc59787c..cd0de7064 100644
--- a/lib/puppet/util/adsi.rb
+++ b/lib/puppet/util/adsi.rb
@@ -1,300 +1,289 @@
 module Puppet::Util::ADSI
   class << self
     def connectable?(uri)
       begin
         !! connect(uri)
       rescue
         false
       end
     end
 
     def connect(uri)
       begin
         WIN32OLE.connect(uri)
       rescue Exception => e
         raise Puppet::Error.new( "ADSI connection error: #{e}" )
       end
     end
 
     def create(name, resource_type)
       Puppet::Util::ADSI.connect(computer_uri).Create(resource_type, name)
     end
 
     def delete(name, resource_type)
       Puppet::Util::ADSI.connect(computer_uri).Delete(resource_type, name)
     end
 
     def computer_name
       unless @computer_name
         buf = " " * 128
         Win32API.new('kernel32', 'GetComputerName', ['P','P'], 'I').call(buf, buf.length.to_s)
         @computer_name = buf.unpack("A*")
       end
       @computer_name
     end
 
     def computer_uri
       "WinNT://#{computer_name}"
     end
 
     def wmi_resource_uri( host = '.' )
       "winmgmts:{impersonationLevel=impersonate}!//#{host}/root/cimv2"
     end
 
     def uri(resource_name, resource_type)
       "#{computer_uri}/#{resource_name},#{resource_type}"
     end
 
     def execquery(query)
       connect(wmi_resource_uri).execquery(query)
     end
+
+    def sid_for_account(name)
+      sid = nil
+
+      execquery(
+        "SELECT Sid from Win32_Account
+         WHERE Name = '#{name}' AND LocalAccount = true"
+      ).each {|u| sid ||= u.Sid}
+
+      sid
+    end
   end
 
   class User
     extend Enumerable
 
     attr_accessor :native_user
     attr_reader :name
     def initialize(name, native_user = nil)
       @name = name
       @native_user = native_user
     end
 
     def native_user
       @native_user ||= Puppet::Util::ADSI.connect(uri)
     end
 
     def self.uri(name)
       Puppet::Util::ADSI.uri(name, 'user')
     end
 
     def uri
       self.class.uri(name)
     end
 
     def self.logon(name, password)
       fLOGON32_LOGON_NETWORK = 3
       fLOGON32_PROVIDER_DEFAULT = 0
 
       logon_user = Win32API.new("advapi32", "LogonUser", ['P', 'P', 'P', 'L', 'L', 'P'], 'L')
       close_handle = Win32API.new("kernel32", "CloseHandle", ['P'], 'V')
 
       token = ' ' * 4
       if logon_user.call(name, "", password, fLOGON32_LOGON_NETWORK, fLOGON32_PROVIDER_DEFAULT, token) != 0
         close_handle.call(token.unpack('L')[0])
         true
       else
         false
       end
     end
 
     def [](attribute)
       native_user.Get(attribute)
     end
 
     def []=(attribute, value)
       native_user.Put(attribute, value)
     end
 
-    def sid
-      sid = nil
-
-      Puppet::Util::ADSI.execquery(
-        "SELECT Sid from Win32_Account
-         WHERE Name = '#{name}' AND LocalAccount = true"
-      ).each {|u| sid ||= u.Sid}
-
-      sid
-    end
-
     def commit
       begin
         native_user.SetInfo unless native_user.nil?
       rescue Exception => e
         raise Puppet::Error.new( "User update failed: #{e}" )
       end
       self
     end
 
     def password_is?(password)
       self.class.logon(name, password)
     end
 
     def add_flag(flag_name, value)
       flag = native_user.Get(flag_name) rescue 0
 
       native_user.Put(flag_name, flag | value)
 
       commit
     end
 
     def password=(password)
       native_user.SetPassword(password)
       commit
       fADS_UF_DONT_EXPIRE_PASSWD = 0x10000
       add_flag("UserFlags", fADS_UF_DONT_EXPIRE_PASSWD)
     end
 
     def groups
       # WIN32OLE objects aren't enumerable, so no map
       groups = []
       native_user.Groups.each {|g| groups << g.Name}
       groups
     end
 
     def add_to_groups(*group_names)
       group_names.each do |group_name|
         Puppet::Util::ADSI::Group.new(group_name).add_member(@name)
       end
     end
     alias add_to_group add_to_groups
 
     def remove_from_groups(*group_names)
       group_names.each do |group_name|
         Puppet::Util::ADSI::Group.new(group_name).remove_member(@name)
       end
     end
     alias remove_from_group remove_from_groups
 
     def set_groups(desired_groups, minimum = true)
       return if desired_groups.nil? or desired_groups.empty?
 
       desired_groups = desired_groups.split(',').map(&:strip)
 
       current_groups = self.groups
 
       # First we add the user to all the groups it should be in but isn't
       groups_to_add = desired_groups - current_groups
       add_to_groups(*groups_to_add)
 
       # Then we remove the user from all groups it is in but shouldn't be, if
       # that's been requested
       groups_to_remove = current_groups - desired_groups
       remove_from_groups(*groups_to_remove) unless minimum
     end
 
     def self.create(name)
       new(name, Puppet::Util::ADSI.create(name, 'user'))
     end
 
     def self.exists?(name)
       Puppet::Util::ADSI::connectable?(User.uri(name))
     end
 
     def self.delete(name)
       Puppet::Util::ADSI.delete(name, 'user')
     end
 
     def self.each(&block)
       wql = Puppet::Util::ADSI.execquery("select * from win32_useraccount")
 
       users = []
       wql.each do |u|
         users << new(u.name, u)
       end
 
       users.each(&block)
     end
   end
 
   class Group
     extend Enumerable
 
     attr_accessor :native_group
     attr_reader :name
     def initialize(name, native_group = nil)
       @name = name
       @native_group = native_group
     end
 
     def uri
       self.class.uri(name)
     end
 
     def self.uri(name)
       Puppet::Util::ADSI.uri(name, 'group')
     end
 
     def native_group
       @native_group ||= Puppet::Util::ADSI.connect(uri)
     end
 
-    def sid
-      sid = nil
-
-      Puppet::Util::ADSI.execquery(
-        "SELECT Sid from Win32_Account
-         WHERE Name = '#{name}' AND LocalAccount = true"
-      ).each {|u| sid ||= u.Sid}
-
-      sid
-    end
-
     def commit
       begin
         native_group.SetInfo unless native_group.nil?
       rescue Exception => e
         raise Puppet::Error.new( "Group update failed: #{e}" )
       end
       self
     end
 
     def add_members(*names)
       names.each do |name|
         native_group.Add(Puppet::Util::ADSI::User.uri(name))
       end
     end
     alias add_member add_members
 
     def remove_members(*names)
       names.each do |name|
         native_group.Remove(Puppet::Util::ADSI::User.uri(name))
       end
     end
     alias remove_member remove_members
 
     def members
       # WIN32OLE objects aren't enumerable, so no map
       members = []
       native_group.Members.each {|m| members << m.Name}
       members
     end
 
     def set_members(desired_members)
       return if desired_members.nil? or desired_members.empty?
 
       current_members = self.members
 
       # First we add all missing members
       members_to_add = desired_members - current_members
       add_members(*members_to_add)
 
       # Then we remove all extra members
       members_to_remove = current_members - desired_members
       remove_members(*members_to_remove)
     end
 
     def self.create(name)
       new(name, Puppet::Util::ADSI.create(name, 'group'))
     end
 
     def self.exists?(name)
       Puppet::Util::ADSI.connectable?(Group.uri(name))
     end
 
     def self.delete(name)
       Puppet::Util::ADSI.delete(name, 'group')
     end
 
     def self.each(&block)
       wql = Puppet::Util::ADSI.execquery( "select * from win32_group" )
 
       groups = []
       wql.each do |g|
         groups << new(g.name, g)
       end
 
       groups.each(&block)
     end
   end
 end
diff --git a/spec/integration/util/windows/security_spec.rb b/spec/integration/util/windows/security_spec.rb
index a36515724..ba4adc2a1 100755
--- a/spec/integration/util/windows/security_spec.rb
+++ b/spec/integration/util/windows/security_spec.rb
@@ -1,477 +1,468 @@
 #!/usr/bin/env ruby
 require 'spec_helper'
 
 require 'puppet/util/adsi'
 
 if Puppet.features.microsoft_windows?
   class WindowsSecurityTester
     require 'puppet/util/windows/security'
     include Puppet::Util::Windows::Security
   end
 end
 
 describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_windows? do
   include PuppetSpec::Files
 
   before :all do
-    sid = nil
-
-    wql = Puppet::Util::ADSI.execquery("select Sid from win32_account where name='#{Sys::Admin.get_login}'")
-    wql.each do |u|
-      sid = u.Sid
-      break
-    end
-
     @sids = {
-      :current_user => sid,
-      :admin => Sys::Admin.get_user("Administrator").sid,
-      :guest => Sys::Admin.get_user("Guest").sid,
-
+      :current_user => Puppet::Util::ADSI.sid_for_account(Sys::Admin.get_login),
+      :admin => Puppet::Util::ADSI.sid_for_account("Administrator"),
+      :guest => Puppet::Util::ADSI.sid_for_account("Guest"),
       :users => Win32::Security::SID::BuiltinUsers,
       :power_users => Win32::Security::SID::PowerUsers,
     }
   end
 
   let (:sids) { @sids }
   let (:winsec) { WindowsSecurityTester.new }
 
   shared_examples_for "a securable object" do
     describe "for a normal user" do
       before :each do
         Puppet.features.stubs(:root?).returns(false)
       end
 
       after :each do
         winsec.set_mode(WindowsSecurityTester::S_IRWXU, path)
       end
 
       describe "#owner=" do
         it "should allow setting to the current user" do
           winsec.set_owner(sids[:current_user], path)
         end
 
         it "should raise an exception when setting to a different user" do
           lambda { winsec.set_owner(sids[:guest], path) }.should raise_error(Puppet::Error, /This security ID may not be assigned as the owner of this object./)
         end
       end
 
       describe "#owner" do
         it "it should not be empty" do
           winsec.get_owner(path).should_not be_empty
         end
 
         it "should raise an exception if an invalid path is provided" do
           lambda { winsec.get_owner("c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
         end
       end
 
       describe "#group=" do
         it "should allow setting to a group the current owner is a member of" do
           winsec.set_group(sids[:users], path)
         end
 
         # Unlike unix, if the user has permission to WRITE_OWNER, which the file owner has by default,
         # then they can set the primary group to a group that the user does not belong to.
         it "should allow setting to a group the current owner is not a member of" do
           winsec.set_group(sids[:power_users], path)
         end
       end
 
       describe "#group" do
         it "should not be empty" do
           winsec.get_group(path).should_not be_empty
         end
 
         it "should raise an exception if an invalid path is provided" do
           lambda { winsec.get_group("c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
         end
       end
 
       describe "#mode=" do
         [0000, 0100, 0200, 0300, 0400, 0500, 0600, 0700].each do |mode|
           it "should enforce mode #{mode.to_s(8)}" do
             winsec.set_mode(mode, path)
 
             check_access(mode, path)
           end
         end
 
         it "should round-trip all 64 modes that do not require deny ACEs" do
           0.upto(7).each do |u|
             0.upto(u).each do |g|
               0.upto(g).each do |o|
                 # if user is superset of group, and group superset of other, then
                 # no deny ace is required, and mode can be converted to win32
                 # access mask, and back to mode without loss of information
                 # (provided the owner and group are not the same)
                 next if ((u & g) != g) or ((g & o) != o)
 
                 mode = (u << 6 | g << 3 | o << 0)
                 winsec.set_mode(mode, path)
                 winsec.get_mode(path).to_s(8).should == mode.to_s(8)
               end
             end
           end
         end
 
         describe "for modes that require deny aces" do
           it "should map everyone to group and owner" do
             winsec.set_mode(0426, path)
             winsec.get_mode(path).to_s(8).should == "666"
           end
 
           it "should combine user and group modes when owner and group sids are equal" do
             winsec.set_group(winsec.get_owner(path), path)
 
             winsec.set_mode(0410, path)
             winsec.get_mode(path).to_s(8).should == "550"
           end
         end
 
         describe "for read-only objects" do
           before :each do
             winsec.add_attributes(path, WindowsSecurityTester::FILE_ATTRIBUTE_READONLY)
             (winsec.get_attributes(path) & WindowsSecurityTester::FILE_ATTRIBUTE_READONLY).should be_nonzero
           end
 
           it "should make them writable if any sid has write permission" do
             winsec.set_mode(WindowsSecurityTester::S_IWUSR, path)
             (winsec.get_attributes(path) & WindowsSecurityTester::FILE_ATTRIBUTE_READONLY).should == 0
           end
 
           it "should leave them read-only if no sid has write permission" do
             winsec.set_mode(WindowsSecurityTester::S_IRUSR | WindowsSecurityTester::S_IXGRP, path)
             (winsec.get_attributes(path) & WindowsSecurityTester::FILE_ATTRIBUTE_READONLY).should be_nonzero
           end
         end
 
         it "should raise an exception if an invalid path is provided" do
           lambda { winsec.set_mode(sids[:guest], "c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
         end
       end
 
       describe "#mode" do
         it "should report when extra aces are encounted" do
           winsec.set_acl(path, true) do |acl|
             [ 544, 545, 546, 547 ].each do |rid|
               winsec.add_access_allowed_ace(acl, WindowsSecurityTester::STANDARD_RIGHTS_ALL, "S-1-5-32-#{rid}")
             end
           end
           mode = winsec.get_mode(path)
           (mode & WindowsSecurityTester::S_IEXTRA).should_not == 0
         end
 
         it "should warn if a deny ace is encountered" do
           winsec.set_acl(path) do |acl|
             winsec.add_access_denied_ace(acl, WindowsSecurityTester::FILE_GENERIC_WRITE, sids[:guest])
             winsec.add_access_allowed_ace(acl, WindowsSecurityTester::STANDARD_RIGHTS_ALL | WindowsSecurityTester::SPECIFIC_RIGHTS_ALL, sids[:current_user])
           end
 
           Puppet.expects(:warning).with("Unsupported access control entry type: 0x1")
 
           winsec.get_mode(path)
         end
 
         it "should skip inherit-only ace" do
           winsec.set_acl(path) do |acl|
             winsec.add_access_allowed_ace(acl, WindowsSecurityTester::STANDARD_RIGHTS_ALL | WindowsSecurityTester::SPECIFIC_RIGHTS_ALL, sids[:current_user])
             winsec.add_access_allowed_ace(acl, WindowsSecurityTester::FILE_GENERIC_READ, Win32::Security::SID::Everyone, WindowsSecurityTester::INHERIT_ONLY_ACE | WindowsSecurityTester::OBJECT_INHERIT_ACE)
           end
 
           (winsec.get_mode(path) & WindowsSecurityTester::S_IRWXO).should == 0
         end
 
         it "should raise an exception if an invalid path is provided" do
           lambda { winsec.get_mode("c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
         end
       end
 
       describe "inherited access control entries" do
         it "should be absent when the access control list is protected" do
           winsec.set_mode(WindowsSecurityTester::S_IRWXU, path)
           (winsec.get_mode(path) & WindowsSecurityTester::S_IEXTRA).should == 0
         end
 
         it "should be present when the access control list is unprotected" do
           dir = tmpdir('win_sec_parent')
 
           # add a bunch of aces, make sure we can add to the directory
           allow = WindowsSecurityTester::STANDARD_RIGHTS_ALL | WindowsSecurityTester::SPECIFIC_RIGHTS_ALL
           inherit = WindowsSecurityTester::OBJECT_INHERIT_ACE | WindowsSecurityTester::CONTAINER_INHERIT_ACE
 
           winsec.set_acl(dir, true) do |acl|
             winsec.add_access_allowed_ace(acl, allow, "S-1-1-0", inherit) # everyone
 
             [ 544, 545, 546, 547 ].each do |rid|
               winsec.add_access_allowed_ace(acl, WindowsSecurityTester::STANDARD_RIGHTS_ALL, "S-1-5-32-#{rid}", inherit)
             end
           end
 
           # add a file
           child = File.join(dir, "child")
           File.new(child, "w").close
 
           # unprotect child, it should inherit from parent
           winsec.set_mode(WindowsSecurityTester::S_IRWXU, child, false)
           (winsec.get_mode(child) & WindowsSecurityTester::S_IEXTRA).should == WindowsSecurityTester::S_IEXTRA
         end
       end
     end
 
     describe "for an administrator", :if => Puppet.features.root? do
       before :each do
         winsec.set_owner(sids[:guest], path)
         winsec.set_group(sids[:guest], path)
         winsec.set_mode(WindowsSecurityTester::S_IRWXU | WindowsSecurityTester::S_IRWXG, path)
         lambda { File.open(path, 'r') }.should raise_error(Errno::EACCES)
       end
 
       after :each do
         winsec.set_owner(sids[:current_user], path)
         winsec.set_mode(WindowsSecurityTester::S_IRWXU, path)
       end
 
       describe "#owner=" do
         it "should accept a user sid" do
           winsec.set_owner(sids[:admin], path)
           winsec.get_owner(path).should == sids[:admin]
         end
 
         it "should accept a group sid" do
           winsec.set_owner(sids[:power_users], path)
           winsec.get_owner(path).should == sids[:power_users]
         end
 
         it "should raise an exception if an invalid sid is provided" do
           lambda { winsec.set_owner("foobar", path) }.should raise_error(Puppet::Error, /Failed to convert string SID/)
         end
 
         it "should raise an exception if an invalid path is provided" do
           lambda { winsec.set_owner(sids[:guest], "c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
         end
       end
 
       describe "#group=" do
         it "should accept a group sid" do
           winsec.set_group(sids[:power_users], path)
           winsec.get_group(path).should == sids[:power_users]
         end
 
         it "should accept a user sid" do
           winsec.set_group(sids[:admin], path)
           winsec.get_group(path).should == sids[:admin]
         end
 
         it "should allow owner and group to be the same sid" do
           winsec.set_owner(sids[:power_users], path)
           winsec.set_group(sids[:power_users], path)
           winsec.set_mode(0610, path)
 
           winsec.get_owner(path).should == sids[:power_users]
           winsec.get_group(path).should == sids[:power_users]
           # note group execute permission added to user ace, and then group rwx value
           # reflected to match
           winsec.get_mode(path).to_s(8).should == "770"
         end
 
         it "should raise an exception if an invalid sid is provided" do
           lambda { winsec.set_group("foobar", path) }.should raise_error(Puppet::Error, /Failed to convert string SID/)
         end
 
         it "should raise an exception if an invalid path is provided" do
           lambda { winsec.set_group(sids[:guest], "c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
         end
       end
 
       describe "when the sid is NULL" do
         it "should retrieve an empty owner sid"
         it "should retrieve an empty group sid"
       end
 
       describe "when the sid refers to a deleted trustee" do
         it "should retrieve the user sid" do
           sid = nil
           user = Puppet::Util::ADSI::User.create("delete_me_user")
           user.commit
           begin
             sid = Sys::Admin::get_user(user.name).sid
             winsec.set_owner(sid, path)
             winsec.set_mode(WindowsSecurityTester::S_IRWXU, path)
           ensure
             Puppet::Util::ADSI::User.delete(user.name)
           end
 
           winsec.get_owner(path).should == sid
           winsec.get_mode(path).should == WindowsSecurityTester::S_IRWXU
         end
 
         it "should retrieve the group sid" do
           sid = nil
           group = Puppet::Util::ADSI::Group.create("delete_me_group")
           group.commit
           begin
             sid = Sys::Admin::get_group(group.name).sid
             winsec.set_group(sid, path)
             winsec.set_mode(WindowsSecurityTester::S_IRWXG, path)
           ensure
             Puppet::Util::ADSI::Group.delete(group.name)
           end
           winsec.get_group(path).should == sid
           winsec.get_mode(path).should == WindowsSecurityTester::S_IRWXG
         end
       end
 
       describe "#mode" do
         it "should deny all access when the DACL is empty" do
           winsec.set_acl(path, true) { |acl| }
 
           winsec.get_mode(path).should == 0
         end
 
         # REMIND: ruby crashes when trying to set a NULL DACL
         # it "should allow all when it is nil" do
         #   winsec.set_owner(sids[:current_user], path)
         #   winsec.open_file(path, WindowsSecurityTester::READ_CONTROL | WindowsSecurityTester::WRITE_DAC) do |handle|
         #     winsec.set_security_info(handle, WindowsSecurityTester::DACL_SECURITY_INFORMATION | WindowsSecurityTester::PROTECTED_DACL_SECURITY_INFORMATION, nil)
         #   end
         #   winsec.get_mode(path).to_s(8).should == "777"
         # end
       end
 
       describe "#string_to_sid_ptr" do
         it "should raise an error if an invalid SID is specified" do
           expect do
             winsec.string_to_sid_ptr('foobar')
           end.to raise_error(Puppet::Util::Windows::Error) { |error| error.code.should == 1337 }
         end
 
         it "should yield if a block is given" do
           yielded = nil
           winsec.string_to_sid_ptr('S-1-1-0') do |sid|
             yielded = sid
           end
           yielded.should_not be_nil
         end
 
         it "should allow no block to be specified" do
           winsec.string_to_sid_ptr('S-1-1-0').should be_true
         end
       end
     end
   end
 
   describe "file" do
     let :path do
       path = tmpfile('win_sec_test_file')
       File.new(path, "w").close
       path
     end
 
     it_behaves_like "a securable object" do
       def check_access(mode, path)
         if (mode & WindowsSecurityTester::S_IRUSR).nonzero?
           check_read(path)
         else
           lambda { check_read(path) }.should raise_error(Errno::EACCES)
         end
 
         if (mode & WindowsSecurityTester::S_IWUSR).nonzero?
           check_write(path)
         else
           lambda { check_write(path) }.should raise_error(Errno::EACCES)
         end
 
         if (mode & WindowsSecurityTester::S_IXUSR).nonzero?
           lambda { check_execute(path) }.should raise_error(Errno::ENOEXEC)
         else
           lambda { check_execute(path) }.should raise_error(Errno::EACCES)
         end
       end
 
       def check_read(path)
         File.open(path, 'r').close
       end
 
       def check_write(path)
         File.open(path, 'w').close
       end
 
       def check_execute(path)
         Kernel.exec(path)
       end
     end
 
     describe "locked files" do
       let (:explorer) { File.join(Dir::WINDOWS, "explorer.exe") }
 
       it "should get the owner" do
         winsec.get_owner(explorer).should match /^S-1-5-/
       end
 
       it "should get the group" do
         winsec.get_group(explorer).should match /^S-1-5-/
       end
 
       it "should get the mode" do
         winsec.get_mode(explorer).should == (WindowsSecurityTester::S_IRWXU | WindowsSecurityTester::S_IRWXG | WindowsSecurityTester::S_IEXTRA)
       end
     end
   end
 
   describe "directory" do
     let :path do
       tmpdir('win_sec_test_dir')
     end
 
     it_behaves_like "a securable object" do
       def check_access(mode, path)
         if (mode & WindowsSecurityTester::S_IRUSR).nonzero?
           check_read(path)
         else
           lambda { check_read(path) }.should raise_error(Errno::EACCES)
         end
 
         if (mode & WindowsSecurityTester::S_IWUSR).nonzero?
           check_write(path)
         else
           lambda { check_write(path) }.should raise_error(Errno::EACCES)
         end
 
         if (mode & WindowsSecurityTester::S_IXUSR).nonzero?
           check_execute(path)
         else
           lambda { check_execute(path) }.should raise_error(Errno::EACCES)
         end
       end
 
       def check_read(path)
         Dir.entries(path)
       end
 
       def check_write(path)
         Dir.mkdir(File.join(path, "subdir"))
       end
 
       def check_execute(path)
         Dir.chdir(path) {|dir| }
       end
     end
 
     describe "inheritable aces" do
       it "should be applied to child objects" do
         mode640 = WindowsSecurityTester::S_IRUSR | WindowsSecurityTester::S_IWUSR | WindowsSecurityTester::S_IRGRP
         winsec.set_mode(mode640, path)
 
         newfile = File.join(path, "newfile.txt")
         File.new(newfile, "w").close
 
         newdir = File.join(path, "newdir")
         Dir.mkdir(newdir)
 
         [newfile, newdir].each do |p|
           winsec.get_mode(p).to_s(8).should == mode640.to_s(8)
         end
       end
     end
   end
 end
diff --git a/spec/unit/util/adsi_spec.rb b/spec/unit/util/adsi_spec.rb
index 53ddeeb2c..291bb64dc 100755
--- a/spec/unit/util/adsi_spec.rb
+++ b/spec/unit/util/adsi_spec.rb
@@ -1,232 +1,221 @@
 #!/usr/bin/env ruby
 
 require 'spec_helper'
 
 require 'puppet/util/adsi'
 
 describe Puppet::Util::ADSI do
   let(:connection) { stub 'connection' }
 
   before(:each) do
     Puppet::Util::ADSI.instance_variable_set(:@computer_name, 'testcomputername')
     Puppet::Util::ADSI.stubs(:connect).returns connection
   end
 
   after(:each) do
     Puppet::Util::ADSI.instance_variable_set(:@computer_name, nil)
   end
 
   it "should generate the correct URI for a resource" do
     Puppet::Util::ADSI.uri('test', 'user').should == "WinNT://testcomputername/test,user"
   end
 
   it "should be able to get the name of the computer" do
     Puppet::Util::ADSI.computer_name.should == 'testcomputername'
   end
 
   it "should be able to provide the correct WinNT base URI for the computer" do
     Puppet::Util::ADSI.computer_uri.should == "WinNT://testcomputername"
   end
 
+  describe ".sid_for_account" do
+    it "should return the SID" do
+      result = [stub('account', :Sid => 'S-1-1-50')]
+      connection.expects(:execquery).returns(result)
+
+      Puppet::Util::ADSI.sid_for_account('joe').should == 'S-1-1-50'
+    end
+
+    it "should return nil if the account does not exist" do
+        connection.expects(:execquery).returns([])
+
+      Puppet::Util::ADSI.sid_for_account('foobar').should be_nil
+    end
+  end
+
   describe Puppet::Util::ADSI::User do
     let(:username)  { 'testuser' }
 
     it "should generate the correct URI" do
       Puppet::Util::ADSI::User.uri(username).should == "WinNT://testcomputername/#{username},user"
     end
 
     it "should be able to create a user" do
       adsi_user = stub('adsi')
 
       connection.expects(:Create).with('user', username).returns(adsi_user)
 
       user = Puppet::Util::ADSI::User.create(username)
 
       user.should be_a(Puppet::Util::ADSI::User)
       user.native_user.should == adsi_user
     end
 
     it "should be able to check the existence of a user" do
       Puppet::Util::ADSI.expects(:connect).with("WinNT://testcomputername/#{username},user").returns connection
       Puppet::Util::ADSI::User.exists?(username).should be_true
     end
 
     it "should be able to delete a user" do
       connection.expects(:Delete).with('user', username)
 
       Puppet::Util::ADSI::User.delete(username)
     end
 
     describe "an instance" do
       let(:adsi_user) { stub 'user' }
       let(:user)      { Puppet::Util::ADSI::User.new(username, adsi_user) }
 
       it "should provide its groups as a list of names" do
         names = ["group1", "group2"]
 
         groups = names.map { |name| mock('group', :Name => name) }
 
         adsi_user.expects(:Groups).returns(groups)
 
         user.groups.should =~ names
       end
 
       it "should be able to test whether a given password is correct" do
         Puppet::Util::ADSI::User.expects(:logon).with(username, 'pwdwrong').returns(false)
         Puppet::Util::ADSI::User.expects(:logon).with(username, 'pwdright').returns(true)
 
         user.password_is?('pwdwrong').should be_false
         user.password_is?('pwdright').should be_true
       end
 
       it "should be able to set a password" do
         adsi_user.expects(:SetPassword).with('pwd')
         adsi_user.expects(:SetInfo).at_least_once
 
         flagname = "UserFlags"
         fADS_UF_DONT_EXPIRE_PASSWD = 0x10000
 
         adsi_user.expects(:Get).with(flagname).returns(0)
         adsi_user.expects(:Put).with(flagname, fADS_UF_DONT_EXPIRE_PASSWD)
 
         user.password = 'pwd'
       end
 
-      it "should be able to get its SID" do
-        result = [stub('user', :name => 'joe', :Sid => 'S-1-1-50')]
-        connection.expects(:execquery).returns(result)
-
-        user.sid.should == 'S-1-1-50'
-      end
-
-      it "should return nil if the user does not exist" do
-        connection.expects(:execquery).returns([])
-
-        user.sid.should be_nil
-      end
-
       it "should generate the correct URI" do
         user.uri.should == "WinNT://testcomputername/#{username},user"
       end
 
       describe "when given a set of groups to which to add the user" do
         let(:groups_to_set) { 'group1,group2' }
 
         before(:each) do
           user.expects(:groups).returns ['group2', 'group3']
         end
 
         describe "if membership is specified as inclusive" do
           it "should add the user to those groups, and remove it from groups not in the list" do
             group1 = stub 'group1'
             group1.expects(:Add).with("WinNT://testcomputername/#{username},user")
 
             group3 = stub 'group1'
             group3.expects(:Remove).with("WinNT://testcomputername/#{username},user")
 
             Puppet::Util::ADSI.expects(:connect).with('WinNT://testcomputername/group1,group').returns group1
             Puppet::Util::ADSI.expects(:connect).with('WinNT://testcomputername/group3,group').returns group3
 
             user.set_groups(groups_to_set, false)
           end
         end
 
         describe "if membership is specified as minimum" do
           it "should add the user to the specified groups without affecting its other memberships" do
             group1 = stub 'group1'
             group1.expects(:Add).with("WinNT://testcomputername/#{username},user")
 
             Puppet::Util::ADSI.expects(:connect).with('WinNT://testcomputername/group1,group').returns group1
 
             user.set_groups(groups_to_set, true)
           end
         end
       end
     end
   end
 
   describe Puppet::Util::ADSI::Group do
     let(:groupname)  { 'testgroup' }
 
     describe "an instance" do
       let(:adsi_group) { stub 'group' }
       let(:group)      { Puppet::Util::ADSI::Group.new(groupname, adsi_group) }
 
       it "should be able to add a member" do
         adsi_group.expects(:Add).with("WinNT://testcomputername/someone,user")
 
         group.add_member('someone')
       end
 
       it "should be able to remove a member" do
         adsi_group.expects(:Remove).with("WinNT://testcomputername/someone,user")
 
         group.remove_member('someone')
       end
 
       it "should provide its groups as a list of names" do
         names = ['user1', 'user2']
 
         users = names.map { |name| mock('user', :Name => name) }
 
         adsi_group.expects(:Members).returns(users)
 
         group.members.should =~ names
       end
 
       it "should be able to add a list of users to a group" do
         names = ['user1', 'user2']
         adsi_group.expects(:Members).returns names.map{|n| stub(:Name => n)}
 
         adsi_group.expects(:Remove).with('WinNT://testcomputername/user1,user')
         adsi_group.expects(:Add).with('WinNT://testcomputername/user3,user')
 
         group.set_members(['user2', 'user3'])
       end
 
-      it "should be able to get its SID" do
-        result = [stub('group', :name => 'somegroup', :Sid => 'S-1-1-51')]
-        connection.expects(:execquery).returns(result)
-
-        group.sid.should == 'S-1-1-51'
-      end
-
-      it "should return nil if the group does not exist" do
-        connection.expects(:execquery).returns([])
-
-        group.sid.should be_nil
-      end
-
       it "should generate the correct URI" do
         group.uri.should == "WinNT://testcomputername/#{groupname},group"
       end
     end
 
     it "should generate the correct URI" do
       Puppet::Util::ADSI::Group.uri("people").should == "WinNT://testcomputername/people,group"
     end
 
     it "should be able to create a group" do
       adsi_group = stub("adsi")
 
       connection.expects(:Create).with('group', groupname).returns(adsi_group)
 
       group = Puppet::Util::ADSI::Group.create(groupname)
 
       group.should be_a(Puppet::Util::ADSI::Group)
       group.native_group.should == adsi_group
     end
 
     it "should be able to confirm the existence of a group" do
       Puppet::Util::ADSI.expects(:connect).with("WinNT://testcomputername/#{groupname},group").returns connection
 
       Puppet::Util::ADSI::Group.exists?(groupname).should be_true
     end
 
     it "should be able to delete a group" do
       connection.expects(:Delete).with('group', groupname)
 
       Puppet::Util::ADSI::Group.delete(groupname)
     end
   end
 end