diff --git a/ext/project_data.yaml b/ext/project_data.yaml
index ee3fc71f5..4bff38686 100644
--- a/ext/project_data.yaml
+++ b/ext/project_data.yaml
@@ -1,46 +1,46 @@
 ---
 project: 'puppet'
 author: 'Puppet Labs'
 email: 'info@puppetlabs.com'
 homepage: 'https://github.com/puppetlabs/puppet'
 summary: 'Puppet, an automated configuration management tool'
 description: 'Puppet, an automated configuration management tool'
 version_file: 'lib/puppet/version.rb'
 # files and gem_files are space separated lists
 files: '[A-Z]* install.rb bin lib conf man examples ext tasks spec'
 # The gem specification bits only work on Puppet >= 3.0rc, NOT 2.7.x and earlier
 gem_files: '[A-Z]* install.rb bin lib conf man examples ext tasks spec'
 gem_test_files: 'spec/**/*'
 gem_executables: 'puppet'
 gem_default_executables: 'puppet'
 gem_forge_project: 'puppet'
 gem_runtime_dependencies:
   facter: ['> 1.6', '< 3']
   hiera: '~> 1.0'
   rgen: '~> 0.6.5'
   json_pure:
 gem_rdoc_options:
   - --title
   - "Puppet - Configuration Management"
   - --main
   - README.md
   - --line-numbers
 gem_platform_dependencies:
   x86-mingw32:
     gem_runtime_dependencies:
       # Pinning versions that require native extensions
       ffi: '1.9.0'
       sys-admin: '1.5.6'
       win32-api: '1.4.8'
       win32-dir: '~> 0.4.3'
       win32-eventlog: '~> 0.5.3'
       win32-process: '~> 0.6.5'
-      win32-security: '~> 0.1.4'
+      win32-security: '~> 0.2.5'
       win32-service: '0.7.2'
       win32-taskscheduler: '~> 0.2.2'
       win32console:  '1.3.2'
       windows-api: '~> 0.4.2'
       windows-pr: '~> 1.2.2'
       minitar: '~> 0.5.4'
 bundle_platforms:
   x86-mingw32: mingw
diff --git a/lib/puppet/util/windows/adsi.rb b/lib/puppet/util/windows/adsi.rb
index f621c798f..0b7bfd076 100644
--- a/lib/puppet/util/windows/adsi.rb
+++ b/lib/puppet/util/windows/adsi.rb
@@ -1,394 +1,394 @@
 module Puppet::Util::Windows::ADSI
   require 'ffi'
 
   class << self
     extend FFI::Library
 
     def connectable?(uri)
       begin
         !! connect(uri)
       rescue
         false
       end
     end
 
     def connect(uri)
       begin
         WIN32OLE.connect(uri)
       rescue Exception => e
         raise Puppet::Error.new( "ADSI connection error: #{e}", e )
       end
     end
 
     def create(name, resource_type)
       Puppet::Util::Windows::ADSI.connect(computer_uri).Create(resource_type, name)
     end
 
     def delete(name, resource_type)
       Puppet::Util::Windows::ADSI.connect(computer_uri).Delete(resource_type, name)
     end
 
     # taken from winbase.h
     MAX_COMPUTERNAME_LENGTH = 31
 
     def computer_name
       unless @computer_name
         max_length = MAX_COMPUTERNAME_LENGTH + 1 # NULL terminated
         FFI::MemoryPointer.new(max_length * 2) do |buffer| # wide string
           FFI::MemoryPointer.new(:dword, 1) do |buffer_size|
             buffer_size.write_dword(max_length) # length in TCHARs
 
             if GetComputerNameW(buffer, buffer_size) == FFI::WIN32_FALSE
               raise Puppet::Util::Windows::Error.new("Failed to get computer name")
             end
             @computer_name = buffer.read_wide_string(buffer_size.read_dword)
           end
         end
       end
       @computer_name
     end
 
     def computer_uri(host = '.')
       "WinNT://#{host}"
     end
 
     def wmi_resource_uri( host = '.' )
       "winmgmts:{impersonationLevel=impersonate}!//#{host}/root/cimv2"
     end
 
     # @api private
     def sid_uri_safe(sid)
       return sid_uri(sid) if sid.kind_of?(Win32::Security::SID)
 
       begin
         sid = Win32::Security::SID.new(Win32::Security::SID.string_to_sid(sid))
         sid_uri(sid)
-      rescue Win32::Security::SID::Error
-        return nil
+      rescue SystemCallError
+        nil
       end
     end
 
     def sid_uri(sid)
       raise Puppet::Error.new( "Must use a valid SID object" ) if !sid.kind_of?(Win32::Security::SID)
       "WinNT://#{sid.to_s}"
     end
 
     def uri(resource_name, resource_type, host = '.')
       "#{computer_uri(host)}/#{resource_name},#{resource_type}"
     end
 
     def wmi_connection
       connect(wmi_resource_uri)
     end
 
     def execquery(query)
       wmi_connection.execquery(query)
     end
 
     def sid_for_account(name)
       Puppet.deprecation_warning "Puppet::Util::Windows::ADSI.sid_for_account is deprecated and will be removed in 3.0, use Puppet::Util::Windows::SID.name_to_sid instead."
 
       Puppet::Util::Windows::SID.name_to_sid(name)
     end
 
     ffi_convention :stdcall
 
     # http://msdn.microsoft.com/en-us/library/windows/desktop/ms724295(v=vs.85).aspx
     # BOOL WINAPI GetComputerName(
     #   _Out_    LPTSTR lpBuffer,
     #   _Inout_  LPDWORD lpnSize
     # );
     ffi_lib :kernel32
     attach_function_private :GetComputerNameW,
       [:lpwstr, :lpdword], :win32_bool
   end
 
   class User
     extend Enumerable
 
     attr_accessor :native_user
     attr_reader :name, :sid
     def initialize(name, native_user = nil)
       @name = name
       @native_user = native_user
     end
 
     def self.parse_name(name)
       if name =~ /\//
         raise Puppet::Error.new( "Value must be in DOMAIN\\user style syntax" )
       end
 
       matches = name.scan(/((.*)\\)?(.*)/)
       domain = matches[0][1] || '.'
       account = matches[0][2]
 
       return account, domain
     end
 
     def native_user
       @native_user ||= Puppet::Util::Windows::ADSI.connect(self.class.uri(*self.class.parse_name(@name)))
     end
 
     def sid
       @sid ||= Puppet::Util::Windows::SID.octet_string_to_sid_object(native_user.objectSID)
     end
 
     def self.uri(name, host = '.')
       if sid_uri = Puppet::Util::Windows::ADSI.sid_uri_safe(name) then return sid_uri end
 
       host = '.' if ['NT AUTHORITY', 'BUILTIN', Socket.gethostname].include?(host)
 
       Puppet::Util::Windows::ADSI.uri(name, 'user', host)
     end
 
     def uri
       self.class.uri(sid.account, sid.domain)
     end
 
     def self.logon(name, password)
       Puppet::Util::Windows::User.password_is?(name, password)
     end
 
     def [](attribute)
       native_user.Get(attribute)
     end
 
     def []=(attribute, value)
       native_user.Put(attribute, value)
     end
 
     def commit
       begin
         native_user.SetInfo unless native_user.nil?
       rescue Exception => e
         raise Puppet::Error.new( "User update failed: #{e}", e )
       end
       self
     end
 
     def password_is?(password)
       self.class.logon(name, password)
     end
 
     def add_flag(flag_name, value)
       flag = native_user.Get(flag_name) rescue 0
 
       native_user.Put(flag_name, flag | value)
 
       commit
     end
 
     def password=(password)
       native_user.SetPassword(password)
       commit
       fADS_UF_DONT_EXPIRE_PASSWD = 0x10000
       add_flag("UserFlags", fADS_UF_DONT_EXPIRE_PASSWD)
     end
 
     def groups
       # WIN32OLE objects aren't enumerable, so no map
       groups = []
       native_user.Groups.each {|g| groups << g.Name} rescue nil
       groups
     end
 
     def add_to_groups(*group_names)
       group_names.each do |group_name|
         Puppet::Util::Windows::ADSI::Group.new(group_name).add_member_sids(sid)
       end
     end
     alias add_to_group add_to_groups
 
     def remove_from_groups(*group_names)
       group_names.each do |group_name|
         Puppet::Util::Windows::ADSI::Group.new(group_name).remove_member_sids(sid)
       end
     end
     alias remove_from_group remove_from_groups
 
     def set_groups(desired_groups, minimum = true)
       return if desired_groups.nil? or desired_groups.empty?
 
       desired_groups = desired_groups.split(',').map(&:strip)
 
       current_groups = self.groups
 
       # First we add the user to all the groups it should be in but isn't
       groups_to_add = desired_groups - current_groups
       add_to_groups(*groups_to_add)
 
       # Then we remove the user from all groups it is in but shouldn't be, if
       # that's been requested
       groups_to_remove = current_groups - desired_groups
       remove_from_groups(*groups_to_remove) unless minimum
     end
 
     def self.create(name)
       # Windows error 1379: The specified local group already exists.
       raise Puppet::Error.new( "Cannot create user if group '#{name}' exists." ) if Puppet::Util::Windows::ADSI::Group.exists? name
       new(name, Puppet::Util::Windows::ADSI.create(name, 'user'))
     end
 
     def self.exists?(name)
       Puppet::Util::Windows::ADSI::connectable?(User.uri(*User.parse_name(name)))
     end
 
     def self.delete(name)
       Puppet::Util::Windows::ADSI.delete(name, 'user')
     end
 
     def self.each(&block)
       wql = Puppet::Util::Windows::ADSI.execquery('select name from win32_useraccount where localaccount = "TRUE"')
 
       users = []
       wql.each do |u|
         users << new(u.name)
       end
 
       users.each(&block)
     end
   end
 
   class UserProfile
     def self.delete(sid)
       begin
         Puppet::Util::Windows::ADSI.wmi_connection.Delete("Win32_UserProfile.SID='#{sid}'")
       rescue => e
         # http://social.technet.microsoft.com/Forums/en/ITCG/thread/0f190051-ac96-4bf1-a47f-6b864bfacee5
         # Prior to Vista SP1, there's no builtin way to programmatically
         # delete user profiles (except for delprof.exe). So try to delete
         # but warn if we fail
         raise e unless e.message.include?('80041010')
 
         Puppet.warning "Cannot delete user profile for '#{sid}' prior to Vista SP1"
       end
     end
   end
 
   class Group
     extend Enumerable
 
     attr_accessor :native_group
     attr_reader :name
     def initialize(name, native_group = nil)
       @name = name
       @native_group = native_group
     end
 
     def uri
       self.class.uri(name)
     end
 
     def self.uri(name, host = '.')
       if sid_uri = Puppet::Util::Windows::ADSI.sid_uri_safe(name) then return sid_uri end
 
       Puppet::Util::Windows::ADSI.uri(name, 'group', host)
     end
 
     def native_group
       @native_group ||= Puppet::Util::Windows::ADSI.connect(uri)
     end
 
     def commit
       begin
         native_group.SetInfo unless native_group.nil?
       rescue Exception => e
         raise Puppet::Error.new( "Group update failed: #{e}", e )
       end
       self
     end
 
     def self.name_sid_hash(names)
       return [] if names.nil? or names.empty?
 
       sids = names.map do |name|
         sid = Puppet::Util::Windows::SID.name_to_sid_object(name)
         raise Puppet::Error.new( "Could not resolve username: #{name}" ) if !sid
         [sid.to_s, sid]
       end
 
       Hash[ sids ]
     end
 
     def add_members(*names)
       Puppet.deprecation_warning('Puppet::Util::Windows::ADSI::Group#add_members is deprecated; please use Puppet::Util::Windows::ADSI::Group#add_member_sids')
       sids = self.class.name_sid_hash(names)
       add_member_sids(*sids.values)
     end
     alias add_member add_members
 
     def remove_members(*names)
       Puppet.deprecation_warning('Puppet::Util::Windows::ADSI::Group#remove_members is deprecated; please use Puppet::Util::Windows::ADSI::Group#remove_member_sids')
       sids = self.class.name_sid_hash(names)
       remove_member_sids(*sids.values)
     end
     alias remove_member remove_members
 
     def add_member_sids(*sids)
       sids.each do |sid|
         native_group.Add(Puppet::Util::Windows::ADSI.sid_uri(sid))
       end
     end
 
     def remove_member_sids(*sids)
       sids.each do |sid|
         native_group.Remove(Puppet::Util::Windows::ADSI.sid_uri(sid))
       end
     end
 
     def members
       # WIN32OLE objects aren't enumerable, so no map
       members = []
       native_group.Members.each {|m| members << m.Name}
       members
     end
 
     def member_sids
       sids = []
       native_group.Members.each do |m|
         sids << Puppet::Util::Windows::SID.octet_string_to_sid_object(m.objectSID)
       end
       sids
     end
 
     def set_members(desired_members)
       return if desired_members.nil? or desired_members.empty?
 
       current_hash = Hash[ self.member_sids.map { |sid| [sid.to_s, sid] } ]
       desired_hash = self.class.name_sid_hash(desired_members)
 
       # First we add all missing members
       members_to_add = (desired_hash.keys - current_hash.keys).map { |sid| desired_hash[sid] }
       add_member_sids(*members_to_add)
 
       # Then we remove all extra members
       members_to_remove = (current_hash.keys - desired_hash.keys).map { |sid| current_hash[sid] }
       remove_member_sids(*members_to_remove)
     end
 
     def self.create(name)
       # Windows error 2224: The account already exists.
       raise Puppet::Error.new( "Cannot create group if user '#{name}' exists." ) if Puppet::Util::Windows::ADSI::User.exists? name
       new(name, Puppet::Util::Windows::ADSI.create(name, 'group'))
     end
 
     def self.exists?(name)
       Puppet::Util::Windows::ADSI.connectable?(Group.uri(name))
     end
 
     def self.delete(name)
       Puppet::Util::Windows::ADSI.delete(name, 'group')
     end
 
     def self.each(&block)
       wql = Puppet::Util::Windows::ADSI.execquery( 'select name from win32_group where localaccount = "TRUE"' )
 
       groups = []
       wql.each do |g|
         groups << new(g.name)
       end
 
       groups.each(&block)
     end
   end
 end
diff --git a/spec/integration/util/windows/security_spec.rb b/spec/integration/util/windows/security_spec.rb
index 5aa41f0aa..0043b4e21 100755
--- a/spec/integration/util/windows/security_spec.rb
+++ b/spec/integration/util/windows/security_spec.rb
@@ -1,863 +1,862 @@
 #!/usr/bin/env ruby
 require 'spec_helper'
 
 if Puppet.features.microsoft_windows?
   class WindowsSecurityTester
     require 'puppet/util/windows/security'
     include Puppet::Util::Windows::Security
   end
-
-  FILE = Puppet::Util::Windows::File
 end
 
 describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_windows? do
   include PuppetSpec::Files
 
   before :all do
     @sids = {
       :current_user => Puppet::Util::Windows::SID.name_to_sid(Sys::Admin.get_login),
       :system => Win32::Security::SID::LocalSystem,
       :admin => Puppet::Util::Windows::SID.name_to_sid("Administrator"),
       :administrators => Win32::Security::SID::BuiltinAdministrators,
       :guest => Puppet::Util::Windows::SID.name_to_sid("Guest"),
       :users => Win32::Security::SID::BuiltinUsers,
       :power_users => Win32::Security::SID::PowerUsers,
       :none => Win32::Security::SID::Nobody,
       :everyone => Win32::Security::SID::Everyone
     }
     # The TCP/IP NetBIOS Helper service (aka 'lmhosts') has ended up
     # disabled on some VMs for reasons we couldn't track down. This
     # condition causes tests which rely on resolving UNC style paths
     # (like \\localhost) to fail with unhelpful error messages.
     # Put a check for this upfront to aid debug should this strike again.
     service = Puppet::Type.type(:service).new(:name => 'lmhosts')
     service.provider.status.should == :running
   end
 
   let (:sids) { @sids }
   let (:winsec) { WindowsSecurityTester.new }
+  let (:klass) { Puppet::Util::Windows::File }
 
   def set_group_depending_on_current_user(path)
     if sids[:current_user] == sids[:system]
       # if the current user is SYSTEM, by setting the group to
       # guest, SYSTEM is automagically given full control, so instead
       # override that behavior with SYSTEM as group and a specific mode
       winsec.set_group(sids[:system], path)
       mode = winsec.get_mode(path)
       winsec.set_mode(mode & ~WindowsSecurityTester::S_IRWXG, path)
     else
       winsec.set_group(sids[:guest], path)
     end
   end
 
   def grant_everyone_full_access(path)
     sd = winsec.get_security_descriptor(path)
     everyone = 'S-1-1-0'
     inherit = Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE | Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE
-    sd.dacl.allow(everyone, FILE::FILE_ALL_ACCESS, inherit)
+    sd.dacl.allow(everyone, klass::FILE_ALL_ACCESS, inherit)
     winsec.set_security_descriptor(path, sd)
   end
 
   shared_examples_for "only child owner" do
     it "should allow child owner" do
       winsec.set_owner(sids[:guest], parent)
       winsec.set_group(sids[:current_user], parent)
       winsec.set_mode(0700, parent)
 
       check_delete(path)
     end
 
     it "should deny parent owner" do
       winsec.set_owner(sids[:guest], path)
       winsec.set_group(sids[:current_user], path)
       winsec.set_mode(0700, path)
 
       lambda { check_delete(path) }.should raise_error(Errno::EACCES)
     end
 
     it "should deny group" do
       winsec.set_owner(sids[:guest], path)
       winsec.set_group(sids[:current_user], path)
       winsec.set_mode(0700, path)
 
       lambda { check_delete(path) }.should raise_error(Errno::EACCES)
     end
 
     it "should deny other" do
       winsec.set_owner(sids[:guest], path)
       winsec.set_group(sids[:current_user], path)
       winsec.set_mode(0700, path)
 
       lambda { check_delete(path) }.should raise_error(Errno::EACCES)
     end
   end
 
   shared_examples_for "a securable object" do
     describe "on a volume that doesn't support ACLs" do
       [:owner, :group, :mode].each do |p|
         it "should return nil #{p}" do
           winsec.stubs(:supports_acl?).returns false
 
           winsec.send("get_#{p}", path).should be_nil
         end
       end
     end
 
     describe "on a volume that supports ACLs" do
       describe "for a normal user" do
         before :each do
           Puppet.features.stubs(:root?).returns(false)
         end
 
         after :each do
           winsec.set_mode(WindowsSecurityTester::S_IRWXU, parent)
           winsec.set_mode(WindowsSecurityTester::S_IRWXU, path) if Puppet::FileSystem.exist?(path)
         end
 
         describe "#supports_acl?" do
           %w[c:/ c:\\ c:/windows/system32 \\\\localhost\\C$ \\\\127.0.0.1\\C$\\foo].each do |path|
             it "should accept #{path}" do
               winsec.should be_supports_acl(path)
             end
           end
 
           it "should raise an exception if it cannot get volume information" do
             expect {
               winsec.supports_acl?('foobar')
             }.to raise_error(Puppet::Error, /Failed to get volume information/)
           end
         end
 
         describe "#owner=" do
           it "should allow setting to the current user" do
             winsec.set_owner(sids[:current_user], path)
           end
 
           it "should raise an exception when setting to a different user" do
             lambda { winsec.set_owner(sids[:guest], path) }.should raise_error(Puppet::Error, /This security ID may not be assigned as the owner of this object./)
           end
         end
 
         describe "#owner" do
           it "it should not be empty" do
             winsec.get_owner(path).should_not be_empty
           end
 
           it "should raise an exception if an invalid path is provided" do
             lambda { winsec.get_owner("c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
           end
         end
 
         describe "#group=" do
           it "should allow setting to a group the current owner is a member of" do
             winsec.set_group(sids[:users], path)
           end
 
           # Unlike unix, if the user has permission to WRITE_OWNER, which the file owner has by default,
           # then they can set the primary group to a group that the user does not belong to.
           it "should allow setting to a group the current owner is not a member of" do
             winsec.set_group(sids[:power_users], path)
           end
         end
 
         describe "#group" do
           it "should not be empty" do
             winsec.get_group(path).should_not be_empty
           end
 
           it "should raise an exception if an invalid path is provided" do
             lambda { winsec.get_group("c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
           end
         end
 
         it "should preserve inherited full control for SYSTEM when setting owner and group" do
           # new file has SYSTEM
           system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
           system_aces.should_not be_empty
 
           # when running under SYSTEM account, multiple ACEs come back
           # so we only care that we have at least one of these
           system_aces.any? do |ace|
-            ace.mask == FILE::FILE_ALL_ACCESS
+            ace.mask == klass::FILE_ALL_ACCESS
           end.should be_true
 
           # changing the owner/group will no longer make the SD protected
           winsec.set_group(sids[:power_users], path)
           winsec.set_owner(sids[:administrators], path)
 
           system_aces.find do |ace|
-            ace.mask == FILE::FILE_ALL_ACCESS && ace.inherited?
+            ace.mask == klass::FILE_ALL_ACCESS && ace.inherited?
           end.should_not be_nil
         end
 
         describe "#mode=" do
           (0000..0700).step(0100) do |mode|
             it "should enforce mode #{mode.to_s(8)}" do
               winsec.set_mode(mode, path)
 
               check_access(mode, path)
             end
           end
 
           it "should round-trip all 128 modes that do not require deny ACEs" do
             0.upto(1).each do |s|
               0.upto(7).each do |u|
                 0.upto(u).each do |g|
                   0.upto(g).each do |o|
                     # if user is superset of group, and group superset of other, then
                     # no deny ace is required, and mode can be converted to win32
                     # access mask, and back to mode without loss of information
                     # (provided the owner and group are not the same)
                     next if ((u & g) != g) or ((g & o) != o)
 
                     mode = (s << 9 | u << 6 | g << 3 | o << 0)
                     winsec.set_mode(mode, path)
                     winsec.get_mode(path).to_s(8).should == mode.to_s(8)
                   end
                 end
               end
             end
           end
 
           it "should preserve full control for SYSTEM when setting mode" do
             # new file has SYSTEM
             system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
             system_aces.should_not be_empty
 
             # when running under SYSTEM account, multiple ACEs come back
             # so we only care that we have at least one of these
             system_aces.any? do |ace|
-              ace.mask == FILE::FILE_ALL_ACCESS
+              ace.mask == klass::FILE_ALL_ACCESS
             end.should be_true
 
             # changing the mode will make the SD protected
             winsec.set_group(sids[:none], path)
             winsec.set_mode(0600, path)
 
             # and should have a non-inherited SYSTEM ACE(s)
             system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
             system_aces.each do |ace|
-              ace.mask.should == FILE::FILE_ALL_ACCESS && ! ace.inherited?
+              ace.mask.should == klass::FILE_ALL_ACCESS && ! ace.inherited?
             end
           end
 
           describe "for modes that require deny aces" do
             it "should map everyone to group and owner" do
               winsec.set_mode(0426, path)
               winsec.get_mode(path).to_s(8).should == "666"
             end
 
             it "should combine user and group modes when owner and group sids are equal" do
               winsec.set_group(winsec.get_owner(path), path)
 
               winsec.set_mode(0410, path)
               winsec.get_mode(path).to_s(8).should == "550"
             end
           end
 
           describe "for read-only objects" do
             before :each do
               winsec.set_group(sids[:none], path)
               winsec.set_mode(0600, path)
-              FILE.add_attributes(path, FILE::FILE_ATTRIBUTE_READONLY)
-              (FILE.get_attributes(path) & FILE::FILE_ATTRIBUTE_READONLY).should be_nonzero
+              Puppet::Util::Windows::File.add_attributes(path, klass::FILE_ATTRIBUTE_READONLY)
+              (Puppet::Util::Windows::File.get_attributes(path) & klass::FILE_ATTRIBUTE_READONLY).should be_nonzero
             end
 
             it "should make them writable if any sid has write permission" do
               winsec.set_mode(WindowsSecurityTester::S_IWUSR, path)
-              (FILE.get_attributes(path) & FILE::FILE_ATTRIBUTE_READONLY).should == 0
+              (Puppet::Util::Windows::File.get_attributes(path) & klass::FILE_ATTRIBUTE_READONLY).should == 0
             end
 
             it "should leave them read-only if no sid has write permission and should allow full access for SYSTEM" do
               winsec.set_mode(WindowsSecurityTester::S_IRUSR | WindowsSecurityTester::S_IXGRP, path)
-              (FILE.get_attributes(path) & FILE::FILE_ATTRIBUTE_READONLY).should be_nonzero
+              (Puppet::Util::Windows::File.get_attributes(path) & klass::FILE_ATTRIBUTE_READONLY).should be_nonzero
 
               system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
 
               # when running under SYSTEM account, and set_group / set_owner hasn't been called
               # SYSTEM full access will be restored
               system_aces.any? do |ace|
-                ace.mask == FILE::FILE_ALL_ACCESS
+                ace.mask == klass::FILE_ALL_ACCESS
               end.should be_true
             end
           end
 
           it "should raise an exception if an invalid path is provided" do
             lambda { winsec.set_mode(sids[:guest], "c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
           end
         end
 
         describe "#mode" do
           it "should report when extra aces are encounted" do
             sd = winsec.get_security_descriptor(path)
             (544..547).each do |rid|
-              sd.dacl.allow("S-1-5-32-#{rid}", FILE::STANDARD_RIGHTS_ALL)
+              sd.dacl.allow("S-1-5-32-#{rid}", klass::STANDARD_RIGHTS_ALL)
             end
             winsec.set_security_descriptor(path, sd)
 
             mode = winsec.get_mode(path)
             (mode & WindowsSecurityTester::S_IEXTRA).should == WindowsSecurityTester::S_IEXTRA
           end
 
           it "should return deny aces" do
             sd = winsec.get_security_descriptor(path)
-            sd.dacl.deny(sids[:guest], FILE::FILE_GENERIC_WRITE)
+            sd.dacl.deny(sids[:guest], klass::FILE_GENERIC_WRITE)
             winsec.set_security_descriptor(path, sd)
 
             guest_aces = winsec.get_aces_for_path_by_sid(path, sids[:guest])
             guest_aces.find do |ace|
               ace.type == Puppet::Util::Windows::AccessControlEntry::ACCESS_DENIED_ACE_TYPE
             end.should_not be_nil
           end
 
           it "should skip inherit-only ace" do
             sd = winsec.get_security_descriptor(path)
             dacl = Puppet::Util::Windows::AccessControlList.new
             dacl.allow(
-              sids[:current_user], FILE::STANDARD_RIGHTS_ALL | FILE::SPECIFIC_RIGHTS_ALL
+              sids[:current_user], klass::STANDARD_RIGHTS_ALL | klass::SPECIFIC_RIGHTS_ALL
             )
             dacl.allow(
               sids[:everyone],
-              FILE::FILE_GENERIC_READ,
+              klass::FILE_GENERIC_READ,
               Puppet::Util::Windows::AccessControlEntry::INHERIT_ONLY_ACE | Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE
             )
             winsec.set_security_descriptor(path, sd)
 
             (winsec.get_mode(path) & WindowsSecurityTester::S_IRWXO).should == 0
           end
 
           it "should raise an exception if an invalid path is provided" do
             lambda { winsec.get_mode("c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
           end
         end
 
         describe "inherited access control entries" do
           it "should be absent when the access control list is protected, and should not remove SYSTEM" do
             winsec.set_mode(WindowsSecurityTester::S_IRWXU, path)
 
             mode = winsec.get_mode(path)
             [ WindowsSecurityTester::S_IEXTRA,
               WindowsSecurityTester::S_ISYSTEM_MISSING ].each do |flag|
               (mode & flag).should_not == flag
             end
           end
 
           it "should be present when the access control list is unprotected" do
             # add a bunch of aces to the parent with permission to add children
-            allow = FILE::STANDARD_RIGHTS_ALL | FILE::SPECIFIC_RIGHTS_ALL
+            allow = klass::STANDARD_RIGHTS_ALL | klass::SPECIFIC_RIGHTS_ALL
             inherit = Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE | Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE
 
             sd = winsec.get_security_descriptor(parent)
             sd.dacl.allow(
               "S-1-1-0", #everyone
               allow,
               inherit
             )
             (544..547).each do |rid|
               sd.dacl.allow(
                 "S-1-5-32-#{rid}",
-                FILE::STANDARD_RIGHTS_ALL,
+                klass::STANDARD_RIGHTS_ALL,
                 inherit
               )
             end
             winsec.set_security_descriptor(parent, sd)
 
             # unprotect child, it should inherit from parent
             winsec.set_mode(WindowsSecurityTester::S_IRWXU, path, false)
             (winsec.get_mode(path) & WindowsSecurityTester::S_IEXTRA).should == WindowsSecurityTester::S_IEXTRA
           end
         end
       end
 
       describe "for an administrator", :if => Puppet.features.root? do
         before :each do
           winsec.set_mode(WindowsSecurityTester::S_IRWXU | WindowsSecurityTester::S_IRWXG, path)
           set_group_depending_on_current_user(path)
           winsec.set_owner(sids[:guest], path)
           lambda { File.open(path, 'r') }.should raise_error(Errno::EACCES)
         end
 
         after :each do
           if Puppet::FileSystem.exist?(path)
             winsec.set_owner(sids[:current_user], path)
             winsec.set_mode(WindowsSecurityTester::S_IRWXU, path)
           end
         end
 
         describe "#owner=" do
           it "should accept a user sid" do
             winsec.set_owner(sids[:admin], path)
             winsec.get_owner(path).should == sids[:admin]
           end
 
           it "should accept a group sid" do
             winsec.set_owner(sids[:power_users], path)
             winsec.get_owner(path).should == sids[:power_users]
           end
 
           it "should raise an exception if an invalid sid is provided" do
             lambda { winsec.set_owner("foobar", path) }.should raise_error(Puppet::Error, /Failed to convert string SID/)
           end
 
           it "should raise an exception if an invalid path is provided" do
             lambda { winsec.set_owner(sids[:guest], "c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
           end
         end
 
         describe "#group=" do
           it "should accept a group sid" do
             winsec.set_group(sids[:power_users], path)
             winsec.get_group(path).should == sids[:power_users]
           end
 
           it "should accept a user sid" do
             winsec.set_group(sids[:admin], path)
             winsec.get_group(path).should == sids[:admin]
           end
 
           it "should combine owner and group rights when they are the same sid" do
             winsec.set_owner(sids[:power_users], path)
             winsec.set_group(sids[:power_users], path)
             winsec.set_mode(0610, path)
 
             winsec.get_owner(path).should == sids[:power_users]
             winsec.get_group(path).should == sids[:power_users]
             # note group execute permission added to user ace, and then group rwx value
             # reflected to match
 
             # Exclude missing system ace, since that's not relevant
             (winsec.get_mode(path) & 0777).to_s(8).should == "770"
           end
 
           it "should raise an exception if an invalid sid is provided" do
             lambda { winsec.set_group("foobar", path) }.should raise_error(Puppet::Error, /Failed to convert string SID/)
           end
 
           it "should raise an exception if an invalid path is provided" do
             lambda { winsec.set_group(sids[:guest], "c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
           end
         end
 
         describe "when the sid is NULL" do
           it "should retrieve an empty owner sid"
           it "should retrieve an empty group sid"
         end
 
         describe "when the sid refers to a deleted trustee" do
           it "should retrieve the user sid" do
             sid = nil
             user = Puppet::Util::Windows::ADSI::User.create("delete_me_user")
             user.commit
             begin
               sid = Sys::Admin::get_user(user.name).sid
               winsec.set_owner(sid, path)
               winsec.set_mode(WindowsSecurityTester::S_IRWXU, path)
             ensure
               Puppet::Util::Windows::ADSI::User.delete(user.name)
             end
 
             winsec.get_owner(path).should == sid
             winsec.get_mode(path).should == WindowsSecurityTester::S_IRWXU
           end
 
           it "should retrieve the group sid" do
             sid = nil
             group = Puppet::Util::Windows::ADSI::Group.create("delete_me_group")
             group.commit
             begin
               sid = Sys::Admin::get_group(group.name).sid
               winsec.set_group(sid, path)
               winsec.set_mode(WindowsSecurityTester::S_IRWXG, path)
             ensure
               Puppet::Util::Windows::ADSI::Group.delete(group.name)
             end
             winsec.get_group(path).should == sid
             winsec.get_mode(path).should == WindowsSecurityTester::S_IRWXG
           end
         end
 
         describe "#mode" do
           it "should deny all access when the DACL is empty, including SYSTEM" do
             sd = winsec.get_security_descriptor(path)
             # don't allow inherited aces to affect the test
             protect = true
             new_sd = Puppet::Util::Windows::SecurityDescriptor.new(sd.owner, sd.group, [], protect)
             winsec.set_security_descriptor(path, new_sd)
 
             winsec.get_mode(path).should == WindowsSecurityTester::S_ISYSTEM_MISSING
           end
 
           # REMIND: ruby crashes when trying to set a NULL DACL
           # it "should allow all when it is nil" do
           #   winsec.set_owner(sids[:current_user], path)
           #   winsec.open_file(path, WindowsSecurityTester::READ_CONTROL | WindowsSecurityTester::WRITE_DAC) do |handle|
           #     winsec.set_security_info(handle, WindowsSecurityTester::DACL_SECURITY_INFORMATION | WindowsSecurityTester::PROTECTED_DACL_SECURITY_INFORMATION, nil)
           #   end
           #   winsec.get_mode(path).to_s(8).should == "777"
           # end
         end
 
         describe "when the parent directory" do
           before :each do
             winsec.set_owner(sids[:current_user], parent)
             winsec.set_owner(sids[:current_user], path)
             winsec.set_mode(0777, path, false)
           end
 
           describe "is writable and executable" do
             describe "and sticky bit is set" do
               it "should allow child owner" do
                 winsec.set_owner(sids[:guest], parent)
                 winsec.set_group(sids[:current_user], parent)
                 winsec.set_mode(01700, parent)
 
                 check_delete(path)
               end
 
               it "should allow parent owner" do
                 winsec.set_owner(sids[:current_user], parent)
                 winsec.set_group(sids[:guest], parent)
                 winsec.set_mode(01700, parent)
 
                 winsec.set_owner(sids[:current_user], path)
                 winsec.set_group(sids[:guest], path)
                 winsec.set_mode(0700, path)
 
                 check_delete(path)
               end
 
               it "should deny group" do
                 winsec.set_owner(sids[:guest], parent)
                 winsec.set_group(sids[:current_user], parent)
                 winsec.set_mode(01770, parent)
 
                 winsec.set_owner(sids[:guest], path)
                 winsec.set_group(sids[:current_user], path)
                 winsec.set_mode(0700, path)
 
                 lambda { check_delete(path) }.should raise_error(Errno::EACCES)
               end
 
               it "should deny other" do
                 winsec.set_owner(sids[:guest], parent)
                 winsec.set_group(sids[:current_user], parent)
                 winsec.set_mode(01777, parent)
 
                 winsec.set_owner(sids[:guest], path)
                 winsec.set_group(sids[:current_user], path)
                 winsec.set_mode(0700, path)
 
                 lambda { check_delete(path) }.should raise_error(Errno::EACCES)
               end
             end
 
             describe "and sticky bit is not set" do
               it "should allow child owner" do
                 winsec.set_owner(sids[:guest], parent)
                 winsec.set_group(sids[:current_user], parent)
                 winsec.set_mode(0700, parent)
 
                 check_delete(path)
               end
 
               it "should allow parent owner" do
                 winsec.set_owner(sids[:current_user], parent)
                 winsec.set_group(sids[:guest], parent)
                 winsec.set_mode(0700, parent)
 
                 winsec.set_owner(sids[:current_user], path)
                 winsec.set_group(sids[:guest], path)
                 winsec.set_mode(0700, path)
 
                 check_delete(path)
               end
 
               it "should allow group" do
                 winsec.set_owner(sids[:guest], parent)
                 winsec.set_group(sids[:current_user], parent)
                 winsec.set_mode(0770, parent)
 
                 winsec.set_owner(sids[:guest], path)
                 winsec.set_group(sids[:current_user], path)
                 winsec.set_mode(0700, path)
 
                 check_delete(path)
               end
 
               it "should allow other" do
                 winsec.set_owner(sids[:guest], parent)
                 winsec.set_group(sids[:current_user], parent)
                 winsec.set_mode(0777, parent)
 
                 winsec.set_owner(sids[:guest], path)
                 winsec.set_group(sids[:current_user], path)
                 winsec.set_mode(0700, path)
 
                 check_delete(path)
               end
             end
           end
 
           describe "is not writable" do
             before :each do
               winsec.set_group(sids[:current_user], parent)
               winsec.set_mode(0555, parent)
             end
 
             it_behaves_like "only child owner"
           end
 
           describe "is not executable" do
             before :each do
               winsec.set_group(sids[:current_user], parent)
               winsec.set_mode(0666, parent)
             end
 
             it_behaves_like "only child owner"
           end
         end
       end
     end
   end
 
   describe "file" do
     let (:parent) do
       tmpdir('win_sec_test_file')
     end
 
     let (:path) do
       path = File.join(parent, 'childfile')
       File.new(path, 'w').close
       path
     end
 
     after :each do
       # allow temp files to be cleaned up
       grant_everyone_full_access(parent)
     end
 
     it_behaves_like "a securable object" do
       def check_access(mode, path)
         if (mode & WindowsSecurityTester::S_IRUSR).nonzero?
           check_read(path)
         else
           lambda { check_read(path) }.should raise_error(Errno::EACCES)
         end
 
         if (mode & WindowsSecurityTester::S_IWUSR).nonzero?
           check_write(path)
         else
           lambda { check_write(path) }.should raise_error(Errno::EACCES)
         end
 
         if (mode & WindowsSecurityTester::S_IXUSR).nonzero?
           lambda { check_execute(path) }.should raise_error(Errno::ENOEXEC)
         else
           lambda { check_execute(path) }.should raise_error(Errno::EACCES)
         end
       end
 
       def check_read(path)
         File.open(path, 'r').close
       end
 
       def check_write(path)
         File.open(path, 'w').close
       end
 
       def check_execute(path)
         Kernel.exec(path)
       end
 
       def check_delete(path)
         File.delete(path)
       end
     end
 
     describe "locked files" do
       let (:explorer) { File.join(Dir::WINDOWS, "explorer.exe") }
 
       it "should get the owner" do
         winsec.get_owner(explorer).should match /^S-1-5-/
       end
 
       it "should get the group" do
         winsec.get_group(explorer).should match /^S-1-5-/
       end
 
       it "should get the mode" do
         winsec.get_mode(explorer).should == (WindowsSecurityTester::S_IRWXU | WindowsSecurityTester::S_IRWXG | WindowsSecurityTester::S_IEXTRA)
       end
     end
   end
 
   describe "directory" do
     let (:parent) do
       tmpdir('win_sec_test_dir')
     end
 
     let (:path) do
       path = File.join(parent, 'childdir')
       Dir.mkdir(path)
       path
     end
 
     after :each do
       # allow temp files to be cleaned up
       grant_everyone_full_access(parent)
     end
 
     it_behaves_like "a securable object" do
       def check_access(mode, path)
         if (mode & WindowsSecurityTester::S_IRUSR).nonzero?
           check_read(path)
         else
           lambda { check_read(path) }.should raise_error(Errno::EACCES)
         end
 
         if (mode & WindowsSecurityTester::S_IWUSR).nonzero?
           check_write(path)
         else
           lambda { check_write(path) }.should raise_error(Errno::EACCES)
         end
 
         if (mode & WindowsSecurityTester::S_IXUSR).nonzero?
           check_execute(path)
         else
           lambda { check_execute(path) }.should raise_error(Errno::EACCES)
         end
       end
 
       def check_read(path)
         Dir.entries(path)
       end
 
       def check_write(path)
         Dir.mkdir(File.join(path, "subdir"))
       end
 
       def check_execute(path)
         Dir.chdir(path) {}
       end
 
       def check_delete(path)
         Dir.rmdir(path)
       end
     end
 
     describe "inheritable aces" do
       it "should be applied to child objects" do
         mode640 = WindowsSecurityTester::S_IRUSR | WindowsSecurityTester::S_IWUSR | WindowsSecurityTester::S_IRGRP
         winsec.set_mode(mode640, path)
 
         newfile = File.join(path, "newfile.txt")
         File.new(newfile, "w").close
 
         newdir = File.join(path, "newdir")
         Dir.mkdir(newdir)
 
         [newfile, newdir].each do |p|
           mode = winsec.get_mode(p)
           (mode & 07777).to_s(8).should == mode640.to_s(8)
         end
       end
     end
   end
 
   context "security descriptor" do
     let(:path) { tmpfile('sec_descriptor') }
     let(:read_execute) { 0x201FF }
     let(:synchronize)  { 0x100000 }
 
     before :each do
       FileUtils.touch(path)
     end
 
     it "preserves aces for other users" do
       dacl = Puppet::Util::Windows::AccessControlList.new
       sids_in_dacl = [sids[:current_user], sids[:users]]
       sids_in_dacl.each do |sid|
         dacl.allow(sid, read_execute)
       end
       sd = Puppet::Util::Windows::SecurityDescriptor.new(sids[:guest], sids[:guest], dacl, true)
       winsec.set_security_descriptor(path, sd)
 
       aces = winsec.get_security_descriptor(path).dacl.to_a
       aces.map(&:sid).should == sids_in_dacl
       aces.map(&:mask).all? { |mask| mask == read_execute }.should be_true
     end
 
     it "changes the sid for all aces that were assigned to the old owner" do
       sd = winsec.get_security_descriptor(path)
       sd.owner.should_not == sids[:guest]
 
       sd.dacl.allow(sd.owner, read_execute)
       sd.dacl.allow(sd.owner, synchronize)
 
       sd.owner = sids[:guest]
       winsec.set_security_descriptor(path, sd)
 
       dacl = winsec.get_security_descriptor(path).dacl
       aces = dacl.find_all { |ace| ace.sid == sids[:guest] }
       # only non-inherited aces will be reassigned to guest, so
       # make sure we find at least the two we added
       aces.size.should >= 2
     end
 
     it "preserves INHERIT_ONLY_ACEs" do
       # inherit only aces can only be set on directories
       dir = tmpdir('inheritonlyace')
 
       inherit_flags = Puppet::Util::Windows::AccessControlEntry::INHERIT_ONLY_ACE |
         Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE |
         Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE
 
       sd = winsec.get_security_descriptor(dir)
-      sd.dacl.allow(sd.owner, FILE::FILE_ALL_ACCESS, inherit_flags)
+      sd.dacl.allow(sd.owner, klass::FILE_ALL_ACCESS, inherit_flags)
       winsec.set_security_descriptor(dir, sd)
 
       sd = winsec.get_security_descriptor(dir)
 
       winsec.set_owner(sids[:guest], dir)
 
       sd = winsec.get_security_descriptor(dir)
       sd.dacl.find do |ace|
         ace.sid == sids[:guest] && ace.inherit_only?
       end.should_not be_nil
     end
 
     it "allows deny ACEs with inheritance" do
       # inheritance can only be set on directories
       dir = tmpdir('denyaces')
 
       inherit_flags = Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE |
           Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE
 
       sd = winsec.get_security_descriptor(dir)
-      sd.dacl.deny(sids[:guest], FILE::FILE_ALL_ACCESS, inherit_flags)
+      sd.dacl.deny(sids[:guest], klass::FILE_ALL_ACCESS, inherit_flags)
       winsec.set_security_descriptor(dir, sd)
 
       sd = winsec.get_security_descriptor(dir)
       sd.dacl.find do |ace|
         ace.sid == sids[:guest] && ace.flags != 0
       end.should_not be_nil
     end
 
     context "when managing mode" do
       it "removes aces for sids that are neither the owner nor group" do
         # add a guest ace, it's never owner or group
         sd = winsec.get_security_descriptor(path)
         sd.dacl.allow(sids[:guest], read_execute)
         winsec.set_security_descriptor(path, sd)
 
         # setting the mode, it should remove extra aces
         winsec.set_mode(0770, path)
 
         # make sure it's gone
         dacl = winsec.get_security_descriptor(path).dacl
         aces = dacl.find_all { |ace| ace.sid == sids[:guest] }
         aces.should be_empty
       end
     end
   end
 end
diff --git a/spec/unit/util/windows/sid_spec.rb b/spec/unit/util/windows/sid_spec.rb
index 5a3d788c7..50f333a8d 100755
--- a/spec/unit/util/windows/sid_spec.rb
+++ b/spec/unit/util/windows/sid_spec.rb
@@ -1,166 +1,166 @@
 #!/usr/bin/env ruby
 require 'spec_helper'
 
 describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows? do
   if Puppet.features.microsoft_windows?
     require 'puppet/util/windows'
   end
 
   let(:subject)      { Puppet::Util::Windows::SID }
   let(:sid)          { Win32::Security::SID::LocalSystem }
   let(:invalid_sid)  { 'bogus' }
   let(:unknown_sid)  { 'S-0-0-0' }
   let(:unknown_name) { 'chewbacca' }
 
   context "#octet_string_to_sid_object" do
     it "should properly convert an array of bytes for the local Administrator SID" do
       host = '.'
       username = 'Administrator'
       admin = WIN32OLE.connect("WinNT://#{host}/#{username},user")
       converted = subject.octet_string_to_sid_object(admin.objectSID)
 
       converted.should == Win32::Security::SID.new(username, host)
       converted.should be_an_instance_of Win32::Security::SID
     end
 
     it "should properly convert an array of bytes for a well-known SID" do
       bytes = [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0]
       converted = subject.octet_string_to_sid_object(bytes)
 
       converted.should == Win32::Security::SID.new('SYSTEM')
       converted.should be_an_instance_of Win32::Security::SID
     end
 
     it "should raise an error for non-array input" do
       expect {
         subject.octet_string_to_sid_object(invalid_sid)
       }.to raise_error(Puppet::Error, /Octet string must be an array of bytes/)
     end
 
     it "should raise an error for an empty byte array" do
       expect {
         subject.octet_string_to_sid_object([])
       }.to raise_error(Puppet::Error, /Octet string must be an array of bytes/)
     end
 
     it "should raise an error for a malformed byte array" do
       expect {
         invalid_octet = [1]
         subject.octet_string_to_sid_object(invalid_octet)
-      }.to raise_error(Win32::Security::SID::Error, /No mapping between account names and security IDs was done./)
+      }.to raise_error(SystemCallError, /No mapping between account names and security IDs was done./)
     end
   end
 
   context "#name_to_sid" do
     it "should return nil if the account does not exist" do
       subject.name_to_sid(unknown_name).should be_nil
     end
 
     it "should accept unqualified account name" do
       subject.name_to_sid('SYSTEM').should == sid
     end
 
     it "should be case-insensitive" do
       subject.name_to_sid('SYSTEM').should == subject.name_to_sid('system')
     end
 
     it "should be leading and trailing whitespace-insensitive" do
       subject.name_to_sid('SYSTEM').should == subject.name_to_sid(' SYSTEM ')
     end
 
     it "should accept domain qualified account names" do
       subject.name_to_sid('NT AUTHORITY\SYSTEM').should == sid
     end
 
     it "should be the identity function for any sid" do
       subject.name_to_sid(sid).should == sid
     end
   end
 
   context "#name_to_sid_object" do
     it "should return nil if the account does not exist" do
       subject.name_to_sid_object(unknown_name).should be_nil
     end
 
     it "should return a Win32::Security::SID instance for any valid sid" do
       subject.name_to_sid_object(sid).should be_an_instance_of(Win32::Security::SID)
     end
 
     it "should accept unqualified account name" do
       subject.name_to_sid_object('SYSTEM').to_s.should == sid
     end
 
     it "should be case-insensitive" do
       subject.name_to_sid_object('SYSTEM').should == subject.name_to_sid_object('system')
     end
 
     it "should be leading and trailing whitespace-insensitive" do
       subject.name_to_sid_object('SYSTEM').should == subject.name_to_sid_object(' SYSTEM ')
     end
 
     it "should accept domain qualified account names" do
       subject.name_to_sid_object('NT AUTHORITY\SYSTEM').to_s.should == sid
     end
   end
 
   context "#sid_to_name" do
     it "should return nil if given a sid for an account that doesn't exist" do
       subject.sid_to_name(unknown_sid).should be_nil
     end
 
     it "should accept a sid" do
       subject.sid_to_name(sid).should == "NT AUTHORITY\\SYSTEM"
     end
   end
 
   context "#sid_ptr_to_string" do
     it "should raise if given an invalid sid" do
       expect {
         subject.sid_ptr_to_string(nil)
       }.to raise_error(Puppet::Error, /Invalid SID/)
     end
 
     it "should yield a valid sid pointer" do
       string = nil
       subject.string_to_sid_ptr(sid) do |ptr|
         string = subject.sid_ptr_to_string(ptr)
       end
       string.should == sid
     end
   end
 
   context "#string_to_sid_ptr" do
     it "should yield sid_ptr" do
       ptr = nil
       subject.string_to_sid_ptr(sid) do |p|
         ptr = p
       end
       ptr.should_not be_nil
     end
 
     it "should raise on an invalid sid" do
       expect {
         subject.string_to_sid_ptr(invalid_sid)
       }.to raise_error(Puppet::Error, /Failed to convert string SID/)
     end
   end
 
   context "#valid_sid?" do
     it "should return true for a valid SID" do
       subject.valid_sid?(sid).should be_true
     end
 
     it "should return false for an invalid SID" do
       subject.valid_sid?(invalid_sid).should be_false
     end
 
     it "should raise if the conversion fails" do
       subject.expects(:string_to_sid_ptr).with(sid).
         raises(Puppet::Util::Windows::Error.new("Failed to convert string SID: #{sid}", Windows::Error::ERROR_ACCESS_DENIED))
 
       expect {
         subject.string_to_sid_ptr(sid) {|ptr| }
       }.to raise_error(Puppet::Util::Windows::Error, /Failed to convert string SID: #{sid}/)
     end
   end
 end