diff --git a/lib/puppet/feature/base.rb b/lib/puppet/feature/base.rb
index 2eddadb7a..cecc1b9ad 100644
--- a/lib/puppet/feature/base.rb
+++ b/lib/puppet/feature/base.rb
@@ -1,63 +1,65 @@
 require 'puppet/util/feature'
 
 # Add the simple features, all in one file.
 
+# Order is important as some features depend on others
+
+# We have a syslog implementation
+Puppet.features.add(:syslog, :libs => ["syslog"])
+
+# We can use POSIX user functions
+Puppet.features.add(:posix) do
+  require 'etc'
+  Etc.getpwuid(0) != nil && Puppet.features.syslog?
+end
+
+# We can use Microsoft Windows functions
+Puppet.features.add(:microsoft_windows) do
+  begin
+    require 'sys/admin'
+    require 'win32/process'
+    require 'win32/dir'
+    require 'win32/service'
+    require 'win32ole'
+    require 'win32/api'
+    true
+  rescue LoadError => err
+    warn "Cannot run on Microsoft Windows without the sys-admin, win32-process, win32-dir & win32-service gems: #{err}" unless Puppet.features.posix?
+  end
+end
+
+raise Puppet::Error,"Cannot determine basic system flavour" unless Puppet.features.posix? or Puppet.features.microsoft_windows?
+
 # We've got LDAP available.
 Puppet.features.add(:ldap, :libs => ["ldap"])
 
 # We have the Rdoc::Usage library.
 Puppet.features.add(:usage, :libs => %w{rdoc/ri/ri_paths rdoc/usage})
 
 # We have libshadow, useful for managing passwords.
 Puppet.features.add(:libshadow, :libs => ["shadow"])
 
 # We're running as root.
 Puppet.features.add(:root) { require 'puppet/util/suidmanager'; Puppet::Util::SUIDManager.root? }
 
 # We've got mongrel available
 Puppet.features.add(:mongrel, :libs => %w{rubygems mongrel puppet/network/http_server/mongrel})
 
 # We have lcs diff
 Puppet.features.add :diff, :libs => %w{diff/lcs diff/lcs/hunk}
 
 # We have augeas
 Puppet.features.add(:augeas, :libs => ["augeas"])
 
 # We have RRD available
 Puppet.features.add(:rrd_legacy, :libs => ["RRDtool"])
 Puppet.features.add(:rrd, :libs => ["RRD"])
 
 # We have OpenSSL
 Puppet.features.add(:openssl, :libs => ["openssl"])
 
-# We have a syslog implementation
-Puppet.features.add(:syslog, :libs => ["syslog"])
-
-# We can use POSIX user functions
-Puppet.features.add(:posix) do
-  require 'etc'
-  Etc.getpwuid(0) != nil && Puppet.features.syslog?
-end
-
-# We can use Microsoft Windows functions
-Puppet.features.add(:microsoft_windows) do
-  begin
-    require 'sys/admin'
-    require 'win32/process'
-    require 'win32/dir'
-    require 'win32/service'
-    require 'win32ole'
-    require 'win32/api'
-    true
-  rescue LoadError => err
-    warn "Cannot run on Microsoft Windows without the sys-admin, win32-process, win32-dir & win32-service gems: #{err}" unless Puppet.features.posix?
-  end
-end
-
-raise Puppet::Error,"Cannot determine basic system flavour" unless Puppet.features.posix? or Puppet.features.microsoft_windows?
-
 # We have CouchDB
 Puppet.features.add(:couchdb, :libs => ["couchrest"])
 
 # We have sqlite
 Puppet.features.add(:sqlite, :libs => ["sqlite3"])
diff --git a/lib/puppet/util/settings.rb b/lib/puppet/util/settings.rb
index caaf61b7b..3039a7b0a 100644
--- a/lib/puppet/util/settings.rb
+++ b/lib/puppet/util/settings.rb
@@ -1,929 +1,930 @@
 require 'puppet'
 require 'sync'
 require 'getoptlong'
 require 'puppet/external/event-loop'
 require 'puppet/util/loadedfile'
 
 # The class for handling configuration files.
 class Puppet::Util::Settings
   include Enumerable
 
   require 'puppet/util/settings/setting'
   require 'puppet/util/settings/file_setting'
   require 'puppet/util/settings/boolean_setting'
 
   attr_accessor :file
   attr_reader :timer
 
   ReadOnly = [:run_mode, :name]
 
   # Retrieve a config value
   def [](param)
     value(param)
   end
 
   # Set a config value.  This doesn't set the defaults, it sets the value itself.
   def []=(param, value)
     set_value(param, value, :memory)
   end
 
   # Generate the list of valid arguments, in a format that GetoptLong can
   # understand, and add them to the passed option list.
   def addargs(options)
     # Add all of the config parameters as valid options.
     self.each { |name, setting|
       setting.getopt_args.each { |args| options << args }
     }
 
     options
   end
 
   # Generate the list of valid arguments, in a format that OptionParser can
   # understand, and add them to the passed option list.
   def optparse_addargs(options)
     # Add all of the config parameters as valid options.
     self.each { |name, setting|
       options << setting.optparse_args
     }
 
     options
   end
 
   # Is our parameter a boolean parameter?
   def boolean?(param)
     param = param.to_sym
     !!(@config.include?(param) and @config[param].kind_of? BooleanSetting)
   end
 
   # Remove all set values, potentially skipping cli values.
   def clear(exceptcli = false)
     @sync.synchronize do
       unsafe_clear(exceptcli)
     end
   end
 
   # Remove all set values, potentially skipping cli values.
   def unsafe_clear(exceptcli = false)
     @values.each do |name, values|
       @values.delete(name) unless exceptcli and name == :cli
     end
 
     # Don't clear the 'used' in this case, since it's a config file reparse,
     # and we want to retain this info.
     @used = [] unless exceptcli
 
     @cache.clear
   end
 
   # This is mostly just used for testing.
   def clearused
     @cache.clear
     @used = []
   end
 
   # Do variable interpolation on the value.
   def convert(value, environment = nil)
     return value unless value
     return value unless value.is_a? String
     newval = value.gsub(/\$(\w+)|\$\{(\w+)\}/) do |value|
       varname = $2 || $1
       if varname == "environment" and environment
         environment
       elsif pval = self.value(varname, environment)
         pval
       else
         raise Puppet::DevError, "Could not find value for #{value}"
       end
     end
 
     newval
   end
 
   # Return a value's description.
   def description(name)
     if obj = @config[name.to_sym]
       obj.desc
     else
       nil
     end
   end
 
   def each
     @config.each { |name, object|
       yield name, object
     }
   end
 
   # Iterate over each section name.
   def eachsection
     yielded = []
     @config.each do |name, object|
       section = object.section
       unless yielded.include? section
         yield section
         yielded << section
       end
     end
   end
 
   # Return an object by name.
   def setting(param)
     param = param.to_sym
     @config[param]
   end
 
   # Handle a command-line argument.
   def handlearg(opt, value = nil)
     @cache.clear
     value &&= munge_value(value)
     str = opt.sub(/^--/,'')
 
     bool = true
     newstr = str.sub(/^no-/, '')
     if newstr != str
       str = newstr
       bool = false
     end
     str = str.intern
 
     if @config[str].is_a?(Puppet::Util::Settings::BooleanSetting)
       if value == "" or value.nil?
         value = bool
       end
     end
 
     set_value(str, value, :cli)
   end
 
   def include?(name)
     name = name.intern if name.is_a? String
     @config.include?(name)
   end
 
   # check to see if a short name is already defined
   def shortinclude?(short)
     short = short.intern if name.is_a? String
     @shortnames.include?(short)
   end
 
   # Create a new collection of config settings.
   def initialize
     @config = {}
     @shortnames = {}
 
     @created = []
     @searchpath = nil
 
     # Mutex-like thing to protect @values
     @sync = Sync.new
 
     # Keep track of set values.
     @values = Hash.new { |hash, key| hash[key] = {} }
 
     # And keep a per-environment cache
     @cache = Hash.new { |hash, key| hash[key] = {} }
 
     # The list of sections we've used.
     @used = []
   end
 
   # NOTE: ACS ahh the util classes. . .sigh
   # as part of a fix for 1183, I pulled the logic for the following 5 methods out of the executables and puppet.rb
   # They probably deserve their own class, but I don't want to do that until I can refactor environments
   # its a little better than where they were
 
   # Prints the contents of a config file with the available config settings, or it
   # prints a single value of a config setting.
   def print_config_options
     env = value(:environment)
     val = value(:configprint)
     if val == "all"
       hash = {}
       each do |name, obj|
         val = value(name,env)
         val = val.inspect if val == ""
         hash[name] = val
       end
       hash.sort { |a,b| a[0].to_s <=> b[0].to_s }.each do |name, val|
         puts "#{name} = #{val}"
       end
     else
       val.split(/\s*,\s*/).sort.each do |v|
         if include?(v)
           #if there is only one value, just print it for back compatibility
           if v == val
             puts value(val,env)
             break
           end
           puts "#{v} = #{value(v,env)}"
         else
           puts "invalid parameter: #{v}"
           return false
         end
       end
     end
     true
   end
 
   def generate_config
     puts to_config
     true
   end
 
   def generate_manifest
     puts to_manifest
     true
   end
 
   def print_configs
     return print_config_options if value(:configprint) != ""
     return generate_config if value(:genconfig)
     generate_manifest if value(:genmanifest)
   end
 
   def print_configs?
     (value(:configprint) != "" || value(:genconfig) || value(:genmanifest)) && true
   end
 
   # Return a given object's file metadata.
   def metadata(param)
     if obj = @config[param.to_sym] and obj.is_a?(FileSetting)
       return [:owner, :group, :mode].inject({}) do |meta, p|
         if v = obj.send(p)
           meta[p] = v
         end
         meta
       end
     else
       nil
     end
   end
 
   # Make a directory with the appropriate user, group, and mode
   def mkdir(default)
     obj = get_config_file_default(default)
 
     Puppet::Util::SUIDManager.asuser(obj.owner, obj.group) do
       mode = obj.mode || 0750
       Dir.mkdir(obj.value, mode)
     end
   end
 
   # Figure out the section name for the run_mode.
   def run_mode
     Puppet.run_mode.name
   end
 
   # Return all of the parameters associated with a given section.
   def params(section = nil)
     if section
       section = section.intern if section.is_a? String
       @config.find_all { |name, obj|
         obj.section == section
       }.collect { |name, obj|
         name
       }
     else
       @config.keys
     end
   end
 
   # Parse the configuration file.  Just provides
   # thread safety.
   def parse
     raise "No :config setting defined; cannot parse unknown config file" unless self[:config]
 
     @sync.synchronize do
       unsafe_parse(self[:config])
     end
 
     # Create a timer so that this file will get checked automatically
     # and reparsed if necessary.
     set_filetimeout_timer
   end
 
   # Unsafely parse the file -- this isn't thread-safe and causes plenty of problems if used directly.
   def unsafe_parse(file)
     return unless FileTest.exist?(file)
     begin
       data = parse_file(file)
     rescue => details
       puts details.backtrace if Puppet[:trace]
       Puppet.err "Could not parse #{file}: #{details}"
       return
     end
 
     unsafe_clear(true)
 
     metas = {}
     data.each do |area, values|
       metas[area] = values.delete(:_meta)
       values.each do |key,value|
         set_value(key, value, area, :dont_trigger_handles => true, :ignore_bad_settings => true )
       end
     end
 
     # Determine our environment, if we have one.
     if @config[:environment]
       env = self.value(:environment).to_sym
     else
       env = "none"
     end
 
     # Call any hooks we should be calling.
     settings_with_hooks.each do |setting|
       each_source(env) do |source|
         if value = @values[source][setting.name]
           # We still have to use value to retrieve the value, since
           # we want the fully interpolated value, not $vardir/lib or whatever.
           # This results in extra work, but so few of the settings
           # will have associated hooks that it ends up being less work this
           # way overall.
           setting.handle(self.value(setting.name, env))
           break
         end
       end
     end
 
     # We have to do it in the reverse of the search path,
     # because multiple sections could set the same value
     # and I'm too lazy to only set the metadata once.
     searchpath.reverse.each do |source|
       source = run_mode if source == :run_mode
       source = @name if (@name && source == :name)
       if meta = metas[source]
         set_metadata(meta)
       end
     end
   end
 
   # Create a new setting.  The value is passed in because it's used to determine
   # what kind of setting we're creating, but the value itself might be either
   # a default or a value, so we can't actually assign it.
   def newsetting(hash)
     klass = nil
     hash[:section] = hash[:section].to_sym if hash[:section]
     if type = hash[:type]
       unless klass = {:setting => Setting, :file => FileSetting, :boolean => BooleanSetting}[type]
         raise ArgumentError, "Invalid setting type '#{type}'"
       end
       hash.delete(:type)
     else
       case hash[:default]
       when true, false, "true", "false"
         klass = BooleanSetting
       when /^\$\w+\//, /^\//, /^\w:\//
         klass = FileSetting
       when String, Integer, Float # nothing
         klass = Setting
       else
         raise ArgumentError, "Invalid value '#{hash[:default].inspect}' for #{hash[:name]}"
       end
     end
     hash[:settings] = self
     setting = klass.new(hash)
 
     setting
   end
 
   # This has to be private, because it doesn't add the settings to @config
   private :newsetting
 
   # Iterate across all of the objects in a given section.
   def persection(section)
     section = section.to_sym
     self.each { |name, obj|
       if obj.section == section
         yield obj
       end
     }
   end
 
   def file
     return @file if @file
     if path = self[:config] and FileTest.exist?(path)
       @file = Puppet::Util::LoadedFile.new(path)
     end
   end
 
   # Reparse our config file, if necessary.
   def reparse
     if file and file.changed?
       Puppet.notice "Reparsing #{file.file}"
       parse
       reuse
     end
   end
 
   def reuse
     return unless defined?(@used)
     @sync.synchronize do # yay, thread-safe
       new = @used
       @used = []
       self.use(*new)
     end
   end
 
   # The order in which to search for values.
   def searchpath(environment = nil)
     if environment
       [:cli, :memory, environment, :run_mode, :main, :mutable_defaults]
     else
       [:cli, :memory, :run_mode, :main, :mutable_defaults]
     end
   end
 
   # Get a list of objects per section
   def sectionlist
     sectionlist = []
     self.each { |name, obj|
       section = obj.section || "puppet"
       sections[section] ||= []
       sectionlist << section unless sectionlist.include?(section)
       sections[section] << obj
     }
 
     return sectionlist, sections
   end
 
   def service_user_available?
     return @service_user_available if defined?(@service_user_available)
 
     return @service_user_available = false unless user_name = self[:user]
 
     user = Puppet::Type.type(:user).new :name => self[:user], :audit => :ensure
 
     @service_user_available = user.exists?
   end
 
   def legacy_to_mode(type, param)
     if not defined?(@app_names)
       require 'puppet/util/command_line'
       command_line = Puppet::Util::CommandLine.new
       @app_names = Puppet::Util::CommandLine::LegacyName.inject({}) do |hash, pair|
         app, legacy = pair
         command_line.require_application app
         hash[legacy.to_sym] = Puppet::Application.find(app).run_mode.name
         hash
       end
     end
     if new_type = @app_names[type]
       Puppet.warning "You have configuration parameter $#{param} specified in [#{type}], which is a deprecated section. I'm assuming you meant [#{new_type}]"
       return new_type
     end
     type
   end
 
   def set_value(param, value, type, options = {})
     param = param.to_sym
     unless setting = @config[param]
       if options[:ignore_bad_settings]
         return
       else
         raise ArgumentError,
           "Attempt to assign a value to unknown configuration parameter #{param.inspect}"
       end
     end
     value = setting.munge(value) if setting.respond_to?(:munge)
     setting.handle(value) if setting.respond_to?(:handle) and not options[:dont_trigger_handles]
     if ReadOnly.include? param and type != :mutable_defaults
       raise ArgumentError,
         "You're attempting to set configuration parameter $#{param}, which is read-only."
     end
     type = legacy_to_mode(type, param)
     @sync.synchronize do # yay, thread-safe
       @values[type][param] = value
       @cache.clear
 
       clearused
 
       # Clear the list of environments, because they cache, at least, the module path.
       # We *could* preferentially just clear them if the modulepath is changed,
       # but we don't really know if, say, the vardir is changed and the modulepath
       # is defined relative to it. We need the defined?(stuff) because of loading
       # order issues.
       Puppet::Node::Environment.clear if defined?(Puppet::Node) and defined?(Puppet::Node::Environment)
     end
 
     value
   end
 
   # Set a bunch of defaults in a given section.  The sections are actually pretty
   # pointless, but they help break things up a bit, anyway.
   def setdefaults(section, defs)
     section = section.to_sym
     call = []
     defs.each { |name, hash|
       if hash.is_a? Array
         unless hash.length == 2
           raise ArgumentError, "Defaults specified as an array must contain only the default value and the decription"
         end
         tmp = hash
         hash = {}
         [:default, :desc].zip(tmp).each { |p,v| hash[p] = v }
       end
       name = name.to_sym
       hash[:name] = name
       hash[:section] = section
       raise ArgumentError, "Parameter #{name} is already defined" if @config.include?(name)
       tryconfig = newsetting(hash)
       if short = tryconfig.short
         if other = @shortnames[short]
           raise ArgumentError, "Parameter #{other.name} is already using short name '#{short}'"
         end
         @shortnames[short] = tryconfig
       end
       @config[name] = tryconfig
 
       # Collect the settings that need to have their hooks called immediately.
       # We have to collect them so that we can be sure we're fully initialized before
       # the hook is called.
       call << tryconfig if tryconfig.call_on_define
     }
 
     call.each { |setting| setting.handle(self.value(setting.name)) }
   end
 
   # Create a timer to check whether the file should be reparsed.
   def set_filetimeout_timer
     return unless timeout = self[:filetimeout] and timeout = Integer(timeout) and timeout > 0
     timer = EventLoop::Timer.new(:interval => timeout, :tolerance => 1, :start? => true) { self.reparse }
   end
 
   # Convert the settings we manage into a catalog full of resources that model those settings.
   def to_catalog(*sections)
     sections = nil if sections.empty?
 
     catalog = Puppet::Resource::Catalog.new("Settings")
 
     @config.values.find_all { |value| value.is_a?(FileSetting) }.each do |file|
       next unless (sections.nil? or sections.include?(file.section))
       next unless resource = file.to_resource
       next if catalog.resource(resource.ref)
 
       catalog.add_resource(resource)
     end
 
     add_user_resources(catalog, sections)
 
     catalog
   end
 
   # Convert our list of config settings into a configuration file.
   def to_config
     str = %{The configuration file for #{Puppet[:name]}.  Note that this file
 is likely to have unused configuration parameters in it; any parameter that's
 valid anywhere in Puppet can be in any config file, even if it's not used.
 
 Every section can specify three special parameters: owner, group, and mode.
 These parameters affect the required permissions of any files specified after
 their specification.  Puppet will sometimes use these parameters to check its
 own configured state, so they can be used to make Puppet a bit more self-managing.
 
 Generated on #{Time.now}.
 
 }.gsub(/^/, "# ")
 
 #         Add a section heading that matches our name.
 if @config.include?(:run_mode)
   str += "[#{self[:run_mode]}]\n"
     end
     eachsection do |section|
       persection(section) do |obj|
         str += obj.to_config + "\n" unless ReadOnly.include? obj.name or obj.name == :genconfig
       end
     end
 
     return str
   end
 
   # Convert to a parseable manifest
   def to_manifest
     catalog = to_catalog
     catalog.resource_refs.collect do |ref|
       catalog.resource(ref).to_manifest
     end.join("\n\n")
   end
 
   # Create the necessary objects to use a section.  This is idempotent;
   # you can 'use' a section as many times as you want.
   def use(*sections)
     sections = sections.collect { |s| s.to_sym }
     @sync.synchronize do # yay, thread-safe
       sections = sections.reject { |s| @used.include?(s) }
 
       return if sections.empty?
 
       begin
         catalog = to_catalog(*sections).to_ral
       rescue => detail
         puts detail.backtrace if Puppet[:trace]
         Puppet.err "Could not create resources for managing Puppet's files and directories in sections #{sections.inspect}: #{detail}"
 
         # We need some way to get rid of any resources created during the catalog creation
         # but not cleaned up.
         return
       end
 
       catalog.host_config = false
       catalog.apply do |transaction|
         if transaction.any_failed?
           report = transaction.report
           failures = report.logs.find_all { |log| log.level == :err }
           raise "Got #{failures.length} failure(s) while initializing: #{failures.collect { |l| l.to_s }.join("; ")}"
         end
       end
 
       sections.each { |s| @used << s }
       @used.uniq!
     end
   end
 
   def valid?(param)
     param = param.to_sym
     @config.has_key?(param)
   end
 
   def uninterpolated_value(param, environment = nil)
     param = param.to_sym
     environment &&= environment.to_sym
 
     # See if we can find it within our searchable list of values
     val = catch :foundval do
       each_source(environment) do |source|
         # Look for the value.  We have to test the hash for whether
         # it exists, because the value might be false.
         @sync.synchronize do
           throw :foundval, @values[source][param] if @values[source].include?(param)
         end
       end
       throw :foundval, nil
     end
 
     # If we didn't get a value, use the default
     val = @config[param].default if val.nil?
 
     val
   end
 
   # Find the correct value using our search path.  Optionally accept an environment
   # in which to search before the other configuration sections.
   def value(param, environment = nil)
     param = param.to_sym
     environment &&= environment.to_sym
 
     # Short circuit to nil for undefined parameters.
     return nil unless @config.include?(param)
 
     # Yay, recursion.
     #self.reparse unless [:config, :filetimeout].include?(param)
 
     # Check the cache first.  It needs to be a per-environment
     # cache so that we don't spread values from one env
     # to another.
     if cached = @cache[environment||"none"][param]
       return cached
     end
 
     val = uninterpolated_value(param, environment)
 
     if param == :code
       # if we interpolate code, all hell breaks loose.
       return val
     end
 
     # Convert it if necessary
     val = convert(val, environment)
 
     # And cache it
     @cache[environment||"none"][param] = val
     val
   end
 
   # Open a file with the appropriate user, group, and mode
   def write(default, *args, &bloc)
     obj = get_config_file_default(default)
     writesub(default, value(obj.name), *args, &bloc)
   end
 
   # Open a non-default file under a default dir with the appropriate user,
   # group, and mode
   def writesub(default, file, *args, &bloc)
     obj = get_config_file_default(default)
     chown = nil
     if Puppet.features.root?
       chown = [obj.owner, obj.group]
     else
       chown = [nil, nil]
     end
 
     Puppet::Util::SUIDManager.asuser(*chown) do
       mode = obj.mode ? obj.mode.to_i : 0640
       args << "w" if args.empty?
 
       args << mode
 
       # Update the umask to make non-executable files
       Puppet::Util.withumask(File.umask ^ 0111) do
         File.open(file, *args) do |file|
           yield file
         end
       end
     end
   end
 
   def readwritelock(default, *args, &bloc)
     file = value(get_config_file_default(default).name)
     tmpfile = file + ".tmp"
     sync = Sync.new
     raise Puppet::DevError, "Cannot create #{file}; directory #{File.dirname(file)} does not exist" unless FileTest.directory?(File.dirname(tmpfile))
 
     sync.synchronize(Sync::EX) do
       File.open(file, ::File::CREAT|::File::RDWR, 0600) do |rf|
         rf.lock_exclusive do
           if File.exist?(tmpfile)
             raise Puppet::Error, ".tmp file already exists for #{file}; Aborting locked write. Check the .tmp file and delete if appropriate"
           end
 
           # If there's a failure, remove our tmpfile
           begin
             writesub(default, tmpfile, *args, &bloc)
           rescue
             File.unlink(tmpfile) if FileTest.exist?(tmpfile)
             raise
           end
 
           begin
             File.rename(tmpfile, file)
           rescue => detail
             Puppet.err "Could not rename #{file} to #{tmpfile}: #{detail}"
             File.unlink(tmpfile) if FileTest.exist?(tmpfile)
           end
         end
       end
     end
   end
 
   private
 
   def get_config_file_default(default)
     obj = nil
     unless obj = @config[default]
       raise ArgumentError, "Unknown default #{default}"
     end
 
     raise ArgumentError, "Default #{default} is not a file" unless obj.is_a? FileSetting
 
     obj
   end
 
   # Create the transportable objects for users and groups.
   def add_user_resources(catalog, sections)
     return unless Puppet.features.root?
+    return if Puppet.features.microsoft_windows?
     return unless self[:mkusers]
 
     @config.each do |name, setting|
       next unless setting.respond_to?(:owner)
       next unless sections.nil? or sections.include?(setting.section)
 
       if user = setting.owner and user != "root" and catalog.resource(:user, user).nil?
         resource = Puppet::Resource.new(:user, user, :parameters => {:ensure => :present})
         resource[:gid] = self[:group] if self[:group]
         catalog.add_resource resource
       end
       if group = setting.group and ! %w{root wheel}.include?(group) and catalog.resource(:group, group).nil?
         catalog.add_resource Puppet::Resource.new(:group, group, :parameters => {:ensure => :present})
       end
     end
   end
 
   # Yield each search source in turn.
   def each_source(environment)
     searchpath(environment).each do |source|
       # Modify the source as necessary.
       source = self.run_mode if source == :run_mode
       yield source
     end
   end
 
   # Return all settings that have associated hooks; this is so
   # we can call them after parsing the configuration file.
   def settings_with_hooks
     @config.values.find_all { |setting| setting.respond_to?(:handle) }
   end
 
   # Extract extra setting information for files.
   def extract_fileinfo(string)
     result = {}
     value = string.sub(/\{\s*([^}]+)\s*\}/) do
       params = $1
       params.split(/\s*,\s*/).each do |str|
         if str =~ /^\s*(\w+)\s*=\s*([\w\d]+)\s*$/
           param, value = $1.intern, $2
           result[param] = value
           raise ArgumentError, "Invalid file option '#{param}'" unless [:owner, :mode, :group].include?(param)
 
           if param == :mode and value !~ /^\d+$/
             raise ArgumentError, "File modes must be numbers"
           end
         else
           raise ArgumentError, "Could not parse '#{string}'"
         end
       end
       ''
     end
     result[:value] = value.sub(/\s*$/, '')
     result
   end
 
   # Convert arguments into booleans, integers, or whatever.
   def munge_value(value)
     # Handle different data types correctly
     return case value
       when /^false$/i; false
       when /^true$/i; true
       when /^\d+$/i; Integer(value)
       when true; true
       when false; false
       else
         value.gsub(/^["']|["']$/,'').sub(/\s+$/, '')
     end
   end
 
   # This method just turns a file in to a hash of hashes.
   def parse_file(file)
     text = read_file(file)
 
     result = Hash.new { |names, name|
       names[name] = {}
     }
 
     count = 0
 
     # Default to 'main' for the section.
     section = :main
     result[section][:_meta] = {}
     text.split(/\n/).each { |line|
       count += 1
       case line
       when /^\s*\[(\w+)\]\s*$/
         section = $1.intern # Section names
         # Add a meta section
         result[section][:_meta] ||= {}
       when /^\s*#/; next # Skip comments
       when /^\s*$/; next # Skip blanks
       when /^\s*(\w+)\s*=\s*(.*?)\s*$/ # settings
         var = $1.intern
 
         # We don't want to munge modes, because they're specified in octal, so we'll
         # just leave them as a String, since Puppet handles that case correctly.
         if var == :mode
           value = $2
         else
           value = munge_value($2)
         end
 
         # Check to see if this is a file argument and it has extra options
         begin
           if value.is_a?(String) and options = extract_fileinfo(value)
             value = options[:value]
             options.delete(:value)
             result[section][:_meta][var] = options
           end
           result[section][var] = value
         rescue Puppet::Error => detail
           detail.file = file
           detail.line = line
           raise
         end
       else
         error = Puppet::Error.new("Could not match line #{line}")
         error.file = file
         error.line = line
         raise error
       end
     }
 
     result
   end
 
   # Read the file in.
   def read_file(file)
     begin
       return File.read(file)
     rescue Errno::ENOENT
       raise ArgumentError, "No such file #{file}"
     rescue Errno::EACCES
       raise ArgumentError, "Permission denied to file #{file}"
     end
   end
 
   # Set file metadata.
   def set_metadata(meta)
     meta.each do |var, values|
       values.each do |param, value|
         @config[var].send(param.to_s + "=", value)
       end
     end
   end
 end
diff --git a/lib/puppet/util/settings/file_setting.rb b/lib/puppet/util/settings/file_setting.rb
index 0fa65d846..f02a0c547 100644
--- a/lib/puppet/util/settings/file_setting.rb
+++ b/lib/puppet/util/settings/file_setting.rb
@@ -1,124 +1,125 @@
 require 'puppet/util/settings/setting'
 
 # A file.
 class Puppet::Util::Settings::FileSetting < Puppet::Util::Settings::Setting
   AllowedOwners = %w{root service}
   AllowedGroups = %w{root service}
 
   class SettingError < StandardError; end
 
   attr_accessor :mode, :create
 
   # Should we create files, rather than just directories?
   def create_files?
     create
   end
 
   def group=(value)
     unless AllowedGroups.include?(value)
       identifying_fields = [desc,name,default].compact.join(': ')
       raise SettingError, "Internal error: The :group setting for #{identifying_fields} must be 'service', not '#{value}'"
     end
     @group = value
   end
 
   def group
     return unless @group
     @settings[:group]
   end
 
   def owner=(value)
     unless AllowedOwners.include?(value)
       identifying_fields = [desc,name,default].compact.join(': ')
       raise SettingError, "Internal error: The :owner setting for #{identifying_fields} must be either 'root' or 'service', not '#{value}'"
     end
     @owner = value
   end
 
   def owner
     return unless @owner
     return "root" if @owner == "root" or ! use_service_user?
     @settings[:user]
   end
 
   def use_service_user?
     @settings[:mkusers] or @settings.service_user_available?
   end
 
   # Set the type appropriately.  Yep, a hack.  This supports either naming
   # the variable 'dir', or adding a slash at the end.
   def munge(value)
     # If it's not a fully qualified path...
     if value.is_a?(String) and value !~ /^\$/ and value != 'false'
       # Make it one
       value = File.expand_path(value)
     end
     if value.to_s =~ /\/$/
       @type = :directory
       return value.sub(/\/$/, '')
     end
     value
   end
 
   # Return the appropriate type.
   def type
     value = @settings.value(self.name)
     if @name.to_s =~ /dir/
       return :directory
     elsif value.to_s =~ /\/$/
       return :directory
     elsif value.is_a? String
       return :file
     else
       return nil
     end
   end
 
   # Turn our setting thing into a Puppet::Resource instance.
   def to_resource
     return nil unless type = self.type
 
     path = self.value
 
     return nil unless path.is_a?(String)
 
     # Make sure the paths are fully qualified.
     path = File.expand_path(path)
 
     return nil unless type == :directory or create_files? or File.exist?(path)
     return nil if path =~ /^\/dev/ or path =~ /^[A-Z]:\/dev/i
 
     resource = Puppet::Resource.new(:file, path)
 
     if Puppet[:manage_internal_file_permissions]
       resource[:mode] = self.mode if self.mode
 
-      if Puppet.features.root?
+      # REMIND fails on Windows because chown/chgrp functionality not supported yet
+      if Puppet.features.root? and !Puppet.features.microsoft_windows?
         resource[:owner] = self.owner if self.owner
         resource[:group] = self.group if self.group
       end
     end
 
     resource[:ensure] = type
     resource[:loglevel] = :debug
     resource[:links] = :follow
     resource[:backup] = false
 
     resource.tag(self.section, self.name, "settings")
 
     resource
   end
 
   # Make sure any provided variables look up to something.
   def validate(value)
     return true unless value.is_a? String
     value.scan(/\$(\w+)/) { |name|
       name = $1
       unless @settings.include?(name)
         raise ArgumentError,
           "Settings parameter '#{name}' is undefined"
       end
     }
   end
 end
 
diff --git a/lib/puppet/util/suidmanager.rb b/lib/puppet/util/suidmanager.rb
index 697bce111..d2772002e 100644
--- a/lib/puppet/util/suidmanager.rb
+++ b/lib/puppet/util/suidmanager.rb
@@ -1,140 +1,153 @@
 require 'puppet/util/warnings'
 require 'forwardable'
 
 module Puppet::Util::SUIDManager
   include Puppet::Util::Warnings
   extend Forwardable
 
   # Note groups= is handled specially due to a bug in OS X 10.6
   to_delegate_to_process = [ :euid=, :euid, :egid=, :egid, :uid=, :uid, :gid=, :gid, :groups ]
 
   to_delegate_to_process.each do |method|
     def_delegator Process, method
     module_function method
   end
 
   def osx_maj_ver
     return @osx_maj_ver unless @osx_maj_ver.nil?
     require 'facter'
     # 'kernel' is available without explicitly loading all facts
     if Facter.value('kernel') != 'Darwin'
       @osx_maj_ver = false
       return @osx_maj_ver
     end
     # But 'macosx_productversion_major' requires it.
     Facter.loadfacts
     @osx_maj_ver = Facter.value('macosx_productversion_major')
   end
   module_function :osx_maj_ver
 
   def groups=(grouplist)
     if osx_maj_ver == '10.6'
       return true
     else
       return Process.groups = grouplist
     end
   end
   module_function :groups=
 
   def self.root?
-    Process.uid == 0
+    return Process.uid == 0 unless Puppet.features.microsoft_windows?
+
+    require 'sys/admin'
+    require 'win32/security'
+
+    # if Vista or later, check for unrestricted process token
+    begin
+      return Win32::Security.elevated_security?
+    rescue Win32::Security::Error => e
+      raise e unless e.to_s =~ /Incorrect function/i
+    end
+
+    group = Sys::Admin.get_group("Administrators", :sid => Win32::Security::SID::BuiltinAdministrators)
+    group and group.members.index(Sys::Admin.get_login) != nil
   end
 
   # Runs block setting uid and gid if provided then restoring original ids
   def asuser(new_uid=nil, new_gid=nil)
     return yield if Puppet.features.microsoft_windows? or !root?
 
     old_euid, old_egid = self.euid, self.egid
     begin
       change_group(new_gid) if new_gid
       change_user(new_uid) if new_uid
 
       yield
     ensure
       change_group(old_egid)
       change_user(old_euid)
     end
   end
   module_function :asuser
 
   def change_group(group, permanently=false)
     gid = convert_xid(:gid, group)
     raise Puppet::Error, "No such group #{group}" unless gid
 
     if permanently
       begin
         Process::GID.change_privilege(gid)
       rescue NotImplementedError
         Process.egid = gid
         Process.gid  = gid
       end
     else
       Process.egid = gid
     end
   end
   module_function :change_group
 
   def change_user(user, permanently=false)
     uid = convert_xid(:uid, user)
     raise Puppet::Error, "No such user #{user}" unless uid
 
     if permanently
       begin
         Process::UID.change_privilege(uid)
       rescue NotImplementedError
         # If changing uid, we must be root. So initgroups first here.
         initgroups(uid)
         Process.euid = uid
         Process.uid  = uid
       end
     else
       # If we're already root, initgroups before changing euid. If we're not,
       # change euid (to root) first.
       if Process.euid == 0
         initgroups(uid)
         Process.euid = uid
       else
         Process.euid = uid
         initgroups(uid)
       end
     end
   end
   module_function :change_user
 
   # Make sure the passed argument is a number.
   def convert_xid(type, id)
     map = {:gid => :group, :uid => :user}
     raise ArgumentError, "Invalid id type #{type}" unless map.include?(type)
     ret = Puppet::Util.send(type, id)
     if ret == nil
       raise Puppet::Error, "Invalid #{map[type]}: #{id}"
     end
     ret
   end
   module_function :convert_xid
 
   # Initialize supplementary groups
   def initgroups(user)
     require 'etc'
     Process.initgroups(Etc.getpwuid(user).name, Process.gid)
   end
 
   module_function :initgroups
 
   def run_and_capture(command, new_uid=nil, new_gid=nil)
     output = Puppet::Util.execute(command, :failonfail => false, :combine => true, :uid => new_uid, :gid => new_gid)
     [output, $CHILD_STATUS.dup]
   end
   module_function :run_and_capture
 
   def system(command, new_uid=nil, new_gid=nil)
     status = nil
     asuser(new_uid, new_gid) do
       Kernel.system(command)
       status = $CHILD_STATUS.dup
     end
     status
   end
   module_function :system
 end
 
diff --git a/spec/unit/util/settings/file_setting_spec.rb b/spec/unit/util/settings/file_setting_spec.rb
index 01d891f08..6344cf1b5 100755
--- a/spec/unit/util/settings/file_setting_spec.rb
+++ b/spec/unit/util/settings/file_setting_spec.rb
@@ -1,262 +1,284 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/util/settings'
 require 'puppet/util/settings/file_setting'
 
 describe Puppet::Util::Settings::FileSetting do
   FileSetting = Puppet::Util::Settings::FileSetting
 
   include PuppetSpec::Files
 
   before do
     @basepath = make_absolute("/somepath")
   end
 
   describe "when determining whether the service user should be used" do
     before do
       @settings = mock 'settings'
       @settings.stubs(:[]).with(:mkusers).returns false
       @settings.stubs(:service_user_available?).returns true
     end
 
     it "should be true if the service user is available" do
       @settings.expects(:service_user_available?).returns true
       setting = FileSetting.new(:settings => @settings, :owner => "root", :desc => "a setting")
       setting.should be_use_service_user
     end
 
     it "should be true if 'mkusers' is set" do
       @settings.expects(:[]).with(:mkusers).returns true
       setting = FileSetting.new(:settings => @settings, :owner => "root", :desc => "a setting")
       setting.should be_use_service_user
     end
 
     it "should be false if the service user is not available and 'mkusers' is unset" do
       setting = FileSetting.new(:settings => @settings, :owner => "root", :desc => "a setting")
       setting.should be_use_service_user
     end
   end
 
   describe "when setting the owner" do
     it "should allow the file to be owned by root" do
       root_owner = lambda { FileSetting.new(:settings => mock("settings"), :owner => "root", :desc => "a setting") }
       root_owner.should_not raise_error
     end
 
     it "should allow the file to be owned by the service user" do
       service_owner = lambda { FileSetting.new(:settings => mock("settings"), :owner => "service", :desc => "a setting") }
       service_owner.should_not raise_error
     end
 
     it "should allow the ownership of the file to be unspecified" do
       no_owner = lambda { FileSetting.new(:settings => mock("settings"), :desc => "a setting") }
       no_owner.should_not raise_error
     end
 
     it "should not allow other owners" do
       invalid_owner = lambda { FileSetting.new(:settings => mock("settings"), :owner => "invalid", :desc => "a setting") }
       invalid_owner.should raise_error(FileSetting::SettingError)
     end
   end
 
   describe "when reading the owner" do
     it "should be root when the setting specifies root" do
       setting = FileSetting.new(:settings => mock("settings"), :owner => "root", :desc => "a setting")
       setting.owner.should == "root"
     end
 
     it "should be the owner of the service when the setting specifies service and the service user should be used" do
       settings = mock("settings")
       settings.stubs(:[]).returns "the_service"
 
       setting = FileSetting.new(:settings => settings, :owner => "service", :desc => "a setting")
       setting.expects(:use_service_user?).returns true
       setting.owner.should == "the_service"
     end
 
     it "should be the root when the setting specifies service and the service user should not be used" do
       settings = mock("settings")
       settings.stubs(:[]).returns "the_service"
 
       setting = FileSetting.new(:settings => settings, :owner => "service", :desc => "a setting")
       setting.expects(:use_service_user?).returns false
       setting.owner.should == "root"
     end
 
     it "should be nil when the owner is unspecified" do
       FileSetting.new(:settings => mock("settings"), :desc => "a setting").owner.should be_nil
     end
   end
 
   describe "when setting the group" do
     it "should allow the group to be service" do
       service_group = lambda { FileSetting.new(:settings => mock("settings"), :group => "service", :desc => "a setting") }
       service_group.should_not raise_error
     end
 
     it "should allow the group to be unspecified" do
       no_group = lambda { FileSetting.new(:settings => mock("settings"), :desc => "a setting") }
       no_group.should_not raise_error
     end
 
     it "should not allow invalid groups" do
       invalid_group = lambda { FileSetting.new(:settings => mock("settings"), :group => "invalid", :desc => "a setting") }
       invalid_group.should raise_error(FileSetting::SettingError)
     end
   end
 
   describe "when reading the group" do
     it "should be service when the setting specifies service" do
       setting = FileSetting.new(:settings => mock("settings", :[] => "the_service"), :group => "service", :desc => "a setting")
       setting.group.should == "the_service"
     end
 
     it "should be nil when the group is unspecified" do
       FileSetting.new(:settings => mock("settings"), :desc => "a setting").group.should be_nil
     end
   end
 
   it "should be able to be converted into a resource" do
     FileSetting.new(:settings => mock("settings"), :desc => "eh").should respond_to(:to_resource)
   end
 
   describe "when being converted to a resource" do
     before do
       @settings = mock 'settings'
       @file = Puppet::Util::Settings::FileSetting.new(:settings => @settings, :desc => "eh", :name => :mydir, :section => "mysect")
       @settings.stubs(:value).with(:mydir).returns @basepath
     end
 
     it "should skip files that cannot determine their types" do
       @file.expects(:type).returns nil
       @file.to_resource.should be_nil
     end
 
     it "should skip non-existent files if 'create_files' is not enabled" do
       @file.expects(:create_files?).returns false
       @file.expects(:type).returns :file
       File.expects(:exist?).with(@basepath).returns false
       @file.to_resource.should be_nil
     end
 
     it "should manage existent files even if 'create_files' is not enabled" do
       @file.expects(:create_files?).returns false
       @file.expects(:type).returns :file
       File.expects(:exist?).with(@basepath).returns true
       @file.to_resource.should be_instance_of(Puppet::Resource)
     end
 
     describe "on POSIX systems", :if => Puppet.features.posix? do
       it "should skip files in /dev" do
         @settings.stubs(:value).with(:mydir).returns "/dev/file"
         @file.to_resource.should be_nil
       end
     end
 
     it "should skip files whose paths are not strings" do
       @settings.stubs(:value).with(:mydir).returns :foo
       @file.to_resource.should be_nil
     end
 
     it "should return a file resource with the path set appropriately" do
       resource = @file.to_resource
       resource.type.should == "File"
       resource.title.should == @basepath
     end
 
     it "should fully qualified returned files if necessary (#795)" do
       @settings.stubs(:value).with(:mydir).returns "myfile"
       path = File.join(Dir.getwd, "myfile")
       # Dir.getwd can return windows paths with backslashes, so we normalize them using expand_path
       path = File.expand_path(path) if Puppet.features.microsoft_windows?
       @file.to_resource.title.should == path
     end
 
     it "should set the mode on the file if a mode is provided" do
       @file.mode = 0755
 
       @file.to_resource[:mode].should == 0755
     end
 
     it "should not set the mode on a the file if manage_internal_file_permissions is disabled" do
       Puppet[:manage_internal_file_permissions] = false
 
       @file.stubs(:mode).returns(0755)
 
       @file.to_resource[:mode].should == nil
     end
 
     it "should set the owner if running as root and the owner is provided" do
       Puppet.features.expects(:root?).returns true
+      Puppet.features.stubs(:microsoft_windows?).returns false
+
       @file.stubs(:owner).returns "foo"
       @file.to_resource[:owner].should == "foo"
     end
 
     it "should not set the owner if manage_internal_file_permissions is disabled" do
       Puppet[:manage_internal_file_permissions] = false
       Puppet.features.stubs(:root?).returns true
       @file.stubs(:owner).returns "foo"
 
       @file.to_resource[:owner].should == nil
     end
 
     it "should set the group if running as root and the group is provided" do
       Puppet.features.expects(:root?).returns true
+      Puppet.features.stubs(:microsoft_windows?).returns false
+
       @file.stubs(:group).returns "foo"
       @file.to_resource[:group].should == "foo"
     end
 
     it "should not set the group if manage_internal_file_permissions is disabled" do
       Puppet[:manage_internal_file_permissions] = false
       Puppet.features.stubs(:root?).returns true
       @file.stubs(:group).returns "foo"
 
       @file.to_resource[:group].should == nil
     end
 
 
     it "should not set owner if not running as root" do
       Puppet.features.expects(:root?).returns false
+      Puppet.features.stubs(:microsoft_windows?).returns false
       @file.stubs(:owner).returns "foo"
       @file.to_resource[:owner].should be_nil
     end
 
     it "should not set group if not running as root" do
       Puppet.features.expects(:root?).returns false
+      Puppet.features.stubs(:microsoft_windows?).returns false
       @file.stubs(:group).returns "foo"
       @file.to_resource[:group].should be_nil
     end
 
+    describe "on Microsoft Windows systems" do
+      before :each do
+        Puppet.features.stubs(:microsoft_windows?).returns true
+      end
+
+      it "should not set owner" do
+        @file.stubs(:owner).returns "foo"
+        @file.to_resource[:owner].should be_nil
+      end
+
+      it "should not set group" do
+        @file.stubs(:group).returns "foo"
+        @file.to_resource[:group].should be_nil
+      end
+    end
+
     it "should set :ensure to the file type" do
       @file.expects(:type).returns :directory
       @file.to_resource[:ensure].should == :directory
     end
 
     it "should set the loglevel to :debug" do
       @file.to_resource[:loglevel].should == :debug
     end
 
     it "should set the backup to false" do
       @file.to_resource[:backup].should be_false
     end
 
     it "should tag the resource with the settings section" do
       @file.expects(:section).returns "mysect"
       @file.to_resource.should be_tagged("mysect")
     end
 
     it "should tag the resource with the setting name" do
       @file.to_resource.should be_tagged("mydir")
     end
 
     it "should tag the resource with 'settings'" do
       @file.to_resource.should be_tagged("settings")
     end
 
     it "should set links to 'follow'" do
       @file.to_resource[:links].should == :follow
     end
   end
 end
 
diff --git a/spec/unit/util/settings_spec.rb b/spec/unit/util/settings_spec.rb
index 76f229c0f..69c117f28 100755
--- a/spec/unit/util/settings_spec.rb
+++ b/spec/unit/util/settings_spec.rb
@@ -1,1112 +1,1131 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 require 'ostruct'
 
 describe Puppet::Util::Settings do
   include PuppetSpec::Files
 
   describe "when specifying defaults" do
     before do
       @settings = Puppet::Util::Settings.new
     end
 
     it "should start with no defined parameters" do
       @settings.params.length.should == 0
     end
 
     it "should allow specification of default values associated with a section as an array" do
       @settings.setdefaults(:section, :myvalue => ["defaultval", "my description"])
     end
 
     it "should not allow duplicate parameter specifications" do
       @settings.setdefaults(:section, :myvalue => ["a", "b"])
       lambda { @settings.setdefaults(:section, :myvalue => ["c", "d"]) }.should raise_error(ArgumentError)
     end
 
     it "should allow specification of default values associated with a section as a hash" do
       @settings.setdefaults(:section, :myvalue => {:default => "defaultval", :desc => "my description"})
     end
 
     it "should consider defined parameters to be valid" do
       @settings.setdefaults(:section, :myvalue => ["defaultval", "my description"])
       @settings.valid?(:myvalue).should be_true
     end
 
     it "should require a description when defaults are specified with an array" do
       lambda { @settings.setdefaults(:section, :myvalue => ["a value"]) }.should raise_error(ArgumentError)
     end
 
     it "should require a description when defaults are specified with a hash" do
       lambda { @settings.setdefaults(:section, :myvalue => {:default => "a value"}) }.should raise_error(ArgumentError)
     end
 
     it "should raise an error if we can't guess the type" do
       lambda { @settings.setdefaults(:section, :myvalue => {:default => Object.new, :desc => "An impossible object"}) }.should raise_error(ArgumentError)
     end
 
     it "should support specifying owner, group, and mode when specifying files" do
       @settings.setdefaults(:section, :myvalue => {:default => "/some/file", :owner => "service", :mode => "boo", :group => "service", :desc => "whatever"})
     end
 
     it "should support specifying a short name" do
       @settings.setdefaults(:section, :myvalue => {:default => "w", :desc => "b", :short => "m"})
     end
 
     it "should support specifying the setting type" do
       @settings.setdefaults(:section, :myvalue => {:default => "/w", :desc => "b", :type => :setting})
       @settings.setting(:myvalue).should be_instance_of(Puppet::Util::Settings::Setting)
     end
 
     it "should fail if an invalid setting type is specified" do
       lambda { @settings.setdefaults(:section, :myvalue => {:default => "w", :desc => "b", :type => :foo}) }.should raise_error(ArgumentError)
     end
 
     it "should fail when short names conflict" do
       @settings.setdefaults(:section, :myvalue => {:default => "w", :desc => "b", :short => "m"})
       lambda { @settings.setdefaults(:section, :myvalue => {:default => "w", :desc => "b", :short => "m"}) }.should raise_error(ArgumentError)
     end
   end
 
   describe "when setting values" do
     before do
       @settings = Puppet::Util::Settings.new
       @settings.setdefaults :main, :myval => ["val", "desc"]
       @settings.setdefaults :main, :bool => [true, "desc"]
     end
 
     it "should provide a method for setting values from other objects" do
       @settings[:myval] = "something else"
       @settings[:myval].should == "something else"
     end
 
     it "should support a getopt-specific mechanism for setting values" do
       @settings.handlearg("--myval", "newval")
       @settings[:myval].should == "newval"
     end
 
     it "should support a getopt-specific mechanism for turning booleans off" do
       @settings[:bool] = true
       @settings.handlearg("--no-bool", "")
       @settings[:bool].should == false
     end
 
     it "should support a getopt-specific mechanism for turning booleans on" do
       # Turn it off first
       @settings[:bool] = false
       @settings.handlearg("--bool", "")
       @settings[:bool].should == true
     end
 
     it "should consider a cli setting with no argument to be a boolean" do
       # Turn it off first
       @settings[:bool] = false
       @settings.handlearg("--bool")
       @settings[:bool].should == true
     end
 
     it "should consider a cli setting with an empty string as an argument to be a boolean, if the setting itself is a boolean" do
       # Turn it off first
       @settings[:bool] = false
       @settings.handlearg("--bool", "")
       @settings[:bool].should == true
     end
 
     it "should consider a cli setting with an empty string as an argument to be an empty argument, if the setting itself is not a boolean" do
       @settings[:myval] = "bob"
       @settings.handlearg("--myval", "")
       @settings[:myval].should == ""
     end
 
     it "should consider a cli setting with a boolean as an argument to be a boolean" do
       # Turn it off first
       @settings[:bool] = false
       @settings.handlearg("--bool", "true")
       @settings[:bool].should == true
     end
 
     it "should not consider a cli setting of a non boolean with a boolean as an argument to be a boolean" do
       # Turn it off first
       @settings[:myval] = "bob"
       @settings.handlearg("--no-myval", "")
       @settings[:myval].should == ""
     end
 
     it "should clear the cache when setting getopt-specific values" do
       @settings.setdefaults :mysection, :one => ["whah", "yay"], :two => ["$one yay", "bah"]
       @settings[:two].should == "whah yay"
       @settings.handlearg("--one", "else")
       @settings[:two].should == "else yay"
     end
 
     it "should not clear other values when setting getopt-specific values" do
       @settings[:myval] = "yay"
       @settings.handlearg("--no-bool", "")
       @settings[:myval].should == "yay"
     end
 
     it "should clear the list of used sections" do
       @settings.expects(:clearused)
       @settings[:myval] = "yay"
     end
 
     it "should call passed blocks when values are set" do
       values = []
       @settings.setdefaults(:section, :hooker => {:default => "yay", :desc => "boo", :hook => lambda { |v| values << v }})
       values.should == []
 
       @settings[:hooker] = "something"
       values.should == %w{something}
     end
 
     it "should call passed blocks when values are set via the command line" do
       values = []
       @settings.setdefaults(:section, :hooker => {:default => "yay", :desc => "boo", :hook => lambda { |v| values << v }})
       values.should == []
 
       @settings.handlearg("--hooker", "yay")
 
       values.should == %w{yay}
     end
 
     it "should provide an option to call passed blocks during definition" do
       values = []
       @settings.setdefaults(:section, :hooker => {:default => "yay", :desc => "boo", :call_on_define => true, :hook => lambda { |v| values << v }})
       values.should == %w{yay}
     end
 
     it "should pass the fully interpolated value to the hook when called on definition" do
       values = []
       @settings.setdefaults(:section, :one => ["test", "a"])
       @settings.setdefaults(:section, :hooker => {:default => "$one/yay", :desc => "boo", :call_on_define => true, :hook => lambda { |v| values << v }})
       values.should == %w{test/yay}
     end
 
     it "should munge values using the setting-specific methods" do
       @settings[:bool] = "false"
       @settings[:bool].should == false
     end
 
     it "should prefer cli values to values set in Ruby code" do
       @settings.handlearg("--myval", "cliarg")
       @settings[:myval] = "memarg"
       @settings[:myval].should == "cliarg"
     end
 
     it "should clear the list of environments" do
       Puppet::Node::Environment.expects(:clear).at_least(1)
       @settings[:myval] = "memarg"
     end
 
     it "should raise an error if we try to set 'name'" do
       lambda{ @settings[:name] = "foo" }.should raise_error(ArgumentError)
     end
 
     it "should raise an error if we try to set 'run_mode'" do
       lambda{ @settings[:run_mode] = "foo" }.should raise_error(ArgumentError)
     end
 
     it "should warn and use [master] if we ask for [puppetmasterd]" do
       Puppet.expects(:warning)
       @settings.set_value(:myval, "foo", :puppetmasterd)
 
       @settings.stubs(:run_mode).returns(:master)
       @settings.value(:myval).should == "foo"
     end
 
     it "should warn and use [agent] if we ask for [puppetd]" do
       Puppet.expects(:warning)
       @settings.set_value(:myval, "foo", :puppetd)
 
       @settings.stubs(:run_mode).returns(:agent)
       @settings.value(:myval).should == "foo"
     end
   end
 
   describe "when returning values" do
     before do
       @settings = Puppet::Util::Settings.new
       @settings.setdefaults :section, :config => ["/my/file", "eh"], :one => ["ONE", "a"], :two => ["$one TWO", "b"], :three => ["$one $two THREE", "c"], :four => ["$two $three FOUR", "d"]
       FileTest.stubs(:exist?).returns true
     end
 
     it "should provide a mechanism for returning set values" do
       @settings[:one] = "other"
       @settings[:one].should == "other"
     end
 
     it "should interpolate default values for other parameters into returned parameter values" do
       @settings[:one].should == "ONE"
       @settings[:two].should == "ONE TWO"
       @settings[:three].should == "ONE ONE TWO THREE"
     end
 
     it "should interpolate default values that themselves need to be interpolated" do
       @settings[:four].should == "ONE TWO ONE ONE TWO THREE FOUR"
     end
 
     it "should provide a method for returning uninterpolated values" do
       @settings[:two] = "$one tw0"
       @settings.uninterpolated_value(:two).should  == "$one tw0"
       @settings.uninterpolated_value(:four).should == "$two $three FOUR"
     end
 
     it "should interpolate set values for other parameters into returned parameter values" do
       @settings[:one] = "on3"
       @settings[:two] = "$one tw0"
       @settings[:three] = "$one $two thr33"
       @settings[:four] = "$one $two $three f0ur"
       @settings[:one].should == "on3"
       @settings[:two].should == "on3 tw0"
       @settings[:three].should == "on3 on3 tw0 thr33"
       @settings[:four].should == "on3 on3 tw0 on3 on3 tw0 thr33 f0ur"
     end
 
     it "should not cache interpolated values such that stale information is returned" do
       @settings[:two].should == "ONE TWO"
       @settings[:one] = "one"
       @settings[:two].should == "one TWO"
     end
 
     it "should not cache values such that information from one environment is returned for another environment" do
       text = "[env1]\none = oneval\n[env2]\none = twoval\n"
       @settings.stubs(:read_file).returns(text)
       @settings.parse
 
       @settings.value(:one, "env1").should == "oneval"
       @settings.value(:one, "env2").should == "twoval"
     end
 
     it "should have a run_mode that defaults to user" do
       @settings.run_mode.should == :user
     end
   end
 
   describe "when choosing which value to return" do
     before do
       @settings = Puppet::Util::Settings.new
       @settings.setdefaults :section,
         :config => ["/my/file", "a"],
         :one => ["ONE", "a"],
         :two => ["TWO", "b"]
       FileTest.stubs(:exist?).returns true
       Puppet.stubs(:run_mode).returns stub('run_mode', :name => :mymode)
     end
 
     it "should return default values if no values have been set" do
       @settings[:one].should == "ONE"
     end
 
     it "should return values set on the cli before values set in the configuration file" do
       text = "[main]\none = fileval\n"
       @settings.stubs(:read_file).returns(text)
       @settings.handlearg("--one", "clival")
       @settings.parse
 
       @settings[:one].should == "clival"
     end
 
     it "should return values set on the cli before values set in Ruby" do
       @settings[:one] = "rubyval"
       @settings.handlearg("--one", "clival")
       @settings[:one].should == "clival"
     end
 
     it "should return values set in the mode-specific section before values set in the main section" do
       text = "[main]\none = mainval\n[mymode]\none = modeval\n"
       @settings.stubs(:read_file).returns(text)
       @settings.parse
 
       @settings[:one].should == "modeval"
     end
 
     it "should not return values outside of its search path" do
       text = "[other]\none = oval\n"
       file = "/some/file"
       @settings.stubs(:read_file).returns(text)
       @settings.parse
       @settings[:one].should == "ONE"
     end
 
     it "should return values in a specified environment" do
       text = "[env]\none = envval\n"
       @settings.stubs(:read_file).returns(text)
       @settings.parse
       @settings.value(:one, "env").should == "envval"
     end
 
     it 'should use the current environment for $environment' do
       @settings.setdefaults :main, :myval => ["$environment/foo", "mydocs"]
 
       @settings.value(:myval, "myenv").should == "myenv/foo"
     end
 
     it "should interpolate found values using the current environment" do
       text = "[main]\none = mainval\n[myname]\none = nameval\ntwo = $one/two\n"
       @settings.stubs(:read_file).returns(text)
       @settings.parse
 
       @settings.value(:two, "myname").should == "nameval/two"
     end
 
     it "should return values in a specified environment before values in the main or name sections" do
       text = "[env]\none = envval\n[main]\none = mainval\n[myname]\none = nameval\n"
       @settings.stubs(:read_file).returns(text)
       @settings.parse
       @settings.value(:one, "env").should == "envval"
     end
   end
 
   describe "when parsing its configuration" do
     before do
       @settings = Puppet::Util::Settings.new
       @settings.stubs(:service_user_available?).returns true
       @file = "/some/file"
       @settings.setdefaults :section, :user => ["suser", "doc"], :group => ["sgroup", "doc"]
       @settings.setdefaults :section, :config => ["/some/file", "eh"], :one => ["ONE", "a"], :two => ["$one TWO", "b"], :three => ["$one $two THREE", "c"]
       FileTest.stubs(:exist?).returns true
     end
 
     it "should not ignore the report setting" do
       @settings.setdefaults :section, :report => ["false", "a"]
       myfile = stub "myfile"
       @settings[:config] = myfile
       text = <<-CONF
         [puppetd]
           report=true
       CONF
       @settings.expects(:read_file).returns(text)
       @settings.parse
       @settings[:report].should be_true
     end
 
     it "should use its current ':config' value for the file to parse" do
       myfile = make_absolute("/my/file") # do not stub expand_path here, as this leads to a stack overflow, when mocha tries to use it
       @settings[:config] = myfile
 
       File.expects(:read).with(myfile).returns "[main]"
 
       @settings.parse
     end
 
     it "should fail if no configuration setting is defined" do
       @settings = Puppet::Util::Settings.new
       lambda { @settings.parse }.should raise_error(RuntimeError)
     end
 
     it "should not try to parse non-existent files" do
       FileTest.expects(:exist?).with("/some/file").returns false
 
       File.expects(:read).with("/some/file").never
 
       @settings.parse
     end
 
     it "should set a timer that triggers reparsing, even if the file does not exist" do
       FileTest.expects(:exist?).returns false
       @settings.expects(:set_filetimeout_timer)
 
       @settings.parse
     end
 
     it "should return values set in the configuration file" do
       text = "[main]
       one = fileval
       "
       @settings.expects(:read_file).returns(text)
       @settings.parse
       @settings[:one].should == "fileval"
     end
 
     #484 - this should probably be in the regression area
     it "should not throw an exception on unknown parameters" do
       text = "[main]\nnosuchparam = mval\n"
       @settings.expects(:read_file).returns(text)
       lambda { @settings.parse }.should_not raise_error
     end
 
     it "should convert booleans in the configuration file into Ruby booleans" do
       text = "[main]
       one = true
       two = false
       "
       @settings.expects(:read_file).returns(text)
       @settings.parse
       @settings[:one].should == true
       @settings[:two].should == false
     end
 
     it "should convert integers in the configuration file into Ruby Integers" do
       text = "[main]
       one = 65
       "
       @settings.expects(:read_file).returns(text)
       @settings.parse
       @settings[:one].should == 65
     end
 
     it "should support specifying all metadata (owner, group, mode) in the configuration file" do
       @settings.setdefaults :section, :myfile => ["/myfile", "a"]
 
       otherfile = make_absolute("/other/file")
       text = "[main]
       myfile = #{otherfile} {owner = service, group = service, mode = 644}
       "
       @settings.expects(:read_file).returns(text)
       @settings.parse
       @settings[:myfile].should == otherfile
       @settings.metadata(:myfile).should == {:owner => "suser", :group => "sgroup", :mode => "644"}
     end
 
     it "should support specifying a single piece of metadata (owner, group, or mode) in the configuration file" do
       @settings.setdefaults :section, :myfile => ["/myfile", "a"]
 
       otherfile = make_absolute("/other/file")
       text = "[main]
       myfile = #{otherfile} {owner = service}
       "
       file = "/some/file"
       @settings.expects(:read_file).returns(text)
       @settings.parse
       @settings[:myfile].should == otherfile
       @settings.metadata(:myfile).should == {:owner => "suser"}
     end
 
     it "should call hooks associated with values set in the configuration file" do
       values = []
       @settings.setdefaults :section, :mysetting => {:default => "defval", :desc => "a", :hook => proc { |v| values << v }}
 
       text = "[main]
       mysetting = setval
       "
       @settings.expects(:read_file).returns(text)
       @settings.parse
       values.should == ["setval"]
     end
 
     it "should not call the same hook for values set multiple times in the configuration file" do
       values = []
       @settings.setdefaults :section, :mysetting => {:default => "defval", :desc => "a", :hook => proc { |v| values << v }}
 
       text = "[user]
       mysetting = setval
       [main]
       mysetting = other
       "
       @settings.expects(:read_file).returns(text)
       @settings.parse
       values.should == ["setval"]
     end
 
     it "should pass the environment-specific value to the hook when one is available" do
       values = []
       @settings.setdefaults :section, :mysetting => {:default => "defval", :desc => "a", :hook => proc { |v| values << v }}
       @settings.setdefaults :section, :environment => ["yay", "a"]
       @settings.setdefaults :section, :environments => ["yay,foo", "a"]
 
       text = "[main]
       mysetting = setval
       [yay]
       mysetting = other
       "
       @settings.expects(:read_file).returns(text)
       @settings.parse
       values.should == ["other"]
     end
 
     it "should pass the interpolated value to the hook when one is available" do
       values = []
       @settings.setdefaults :section, :base => {:default => "yay", :desc => "a", :hook => proc { |v| values << v }}
       @settings.setdefaults :section, :mysetting => {:default => "defval", :desc => "a", :hook => proc { |v| values << v }}
 
       text = "[main]
       mysetting = $base/setval
       "
       @settings.expects(:read_file).returns(text)
       @settings.parse
       values.should == ["yay/setval"]
     end
 
     it "should allow empty values" do
       @settings.setdefaults :section, :myarg => ["myfile", "a"]
 
       text = "[main]
       myarg =
       "
       @settings.stubs(:read_file).returns(text)
       @settings.parse
       @settings[:myarg].should == ""
     end
 
     describe "and when reading a non-positive filetimeout value from the config file" do
       before do
         @settings.setdefaults :foo, :filetimeout => [5, "eh"]
 
         somefile = "/some/file"
         text = "[main]
         filetimeout = -1
         "
         File.expects(:read).with(somefile).returns(text)
         File.expects(:expand_path).with(somefile).returns somefile
         @settings[:config] = somefile
       end
 
       it "should not set a timer" do
         EventLoop::Timer.expects(:new).never
 
         @settings.parse
       end
     end
   end
 
   describe "when reparsing its configuration" do
     before do
       @settings = Puppet::Util::Settings.new
       @settings.setdefaults :section, :config => ["/test/file", "a"], :one => ["ONE", "a"], :two => ["$one TWO", "b"], :three => ["$one $two THREE", "c"]
       FileTest.stubs(:exist?).returns true
     end
 
     it "should use a LoadedFile instance to determine if the file has changed" do
       file = mock 'file'
       Puppet::Util::LoadedFile.expects(:new).with("/test/file").returns file
 
       file.expects(:changed?)
 
       @settings.stubs(:parse)
       @settings.reparse
     end
 
     it "should not create the LoadedFile instance and should not parse if the file does not exist" do
       FileTest.expects(:exist?).with("/test/file").returns false
       Puppet::Util::LoadedFile.expects(:new).never
 
       @settings.expects(:parse).never
 
       @settings.reparse
     end
 
     it "should not reparse if the file has not changed" do
       file = mock 'file'
       Puppet::Util::LoadedFile.expects(:new).with("/test/file").returns file
 
       file.expects(:changed?).returns false
 
       @settings.expects(:parse).never
 
       @settings.reparse
     end
 
     it "should reparse if the file has changed" do
       file = stub 'file', :file => "/test/file"
       Puppet::Util::LoadedFile.expects(:new).with("/test/file").returns file
 
       file.expects(:changed?).returns true
 
       @settings.expects(:parse)
 
       @settings.reparse
     end
 
     it "should replace in-memory values with on-file values" do
       # Init the value
       text = "[main]\none = disk-init\n"
       file = mock 'file'
       file.stubs(:changed?).returns(true)
       file.stubs(:file).returns("/test/file")
       @settings[:one] = "init"
       @settings.file = file
 
       # Now replace the value
       text = "[main]\none = disk-replace\n"
 
       # This is kinda ridiculous - the reason it parses twice is that
       # it goes to parse again when we ask for the value, because the
       # mock always says it should get reparsed.
       @settings.stubs(:read_file).returns(text)
       @settings.reparse
       @settings[:one].should == "disk-replace"
     end
 
     it "should retain parameters set by cli when configuration files are reparsed" do
       @settings.handlearg("--one", "clival")
 
       text = "[main]\none = on-disk\n"
       @settings.stubs(:read_file).returns(text)
       @settings.parse
 
       @settings[:one].should == "clival"
     end
 
     it "should remove in-memory values that are no longer set in the file" do
       # Init the value
       text = "[main]\none = disk-init\n"
       @settings.expects(:read_file).returns(text)
       @settings.parse
       @settings[:one].should == "disk-init"
 
       # Now replace the value
       text = "[main]\ntwo = disk-replace\n"
       @settings.expects(:read_file).returns(text)
       @settings.parse
       #@settings.reparse
 
       # The originally-overridden value should be replaced with the default
       @settings[:one].should == "ONE"
 
       # and we should now have the new value in memory
       @settings[:two].should == "disk-replace"
     end
 
     it "should retain in-memory values if the file has a syntax error" do
       # Init the value
       text = "[main]\none = initial-value\n"
       @settings.expects(:read_file).returns(text)
       @settings.parse
       @settings[:one].should == "initial-value"
 
       # Now replace the value with something bogus
       text = "[main]\nkenny = killed-by-what-follows\n1 is 2, blah blah florp\n"
       @settings.expects(:read_file).returns(text)
       @settings.parse
 
       # The originally-overridden value should not be replaced with the default
       @settings[:one].should == "initial-value"
 
       # and we should not have the new value in memory
       @settings[:kenny].should be_nil
     end
   end
 
   it "should provide a method for creating a catalog of resources from its configuration" do
     Puppet::Util::Settings.new.should respond_to(:to_catalog)
   end
 
   describe "when creating a catalog" do
     before do
       @settings = Puppet::Util::Settings.new
       @settings.stubs(:service_user_available?).returns true
       @prefix = Puppet.features.posix? ? "" : "C:"
     end
 
     it "should add all file resources to the catalog if no sections have been specified" do
       @settings.setdefaults :main, :maindir => [@prefix+"/maindir", "a"], :seconddir => [@prefix+"/seconddir", "a"]
       @settings.setdefaults :other, :otherdir => [@prefix+"/otherdir", "a"]
 
       catalog = @settings.to_catalog
 
       [@prefix+"/maindir", @prefix+"/seconddir", @prefix+"/otherdir"].each do |path|
         catalog.resource(:file, path).should be_instance_of(Puppet::Resource)
       end
     end
 
     it "should add only files in the specified sections if section names are provided" do
       @settings.setdefaults :main, :maindir => [@prefix+"/maindir", "a"]
       @settings.setdefaults :other, :otherdir => [@prefix+"/otherdir", "a"]
       catalog = @settings.to_catalog(:main)
       catalog.resource(:file, @prefix+"/otherdir").should be_nil
       catalog.resource(:file, @prefix+"/maindir").should be_instance_of(Puppet::Resource)
     end
 
     it "should not try to add the same file twice" do
       @settings.setdefaults :main, :maindir => [@prefix+"/maindir", "a"]
       @settings.setdefaults :other, :otherdir => [@prefix+"/maindir", "a"]
       lambda { @settings.to_catalog }.should_not raise_error
     end
 
     it "should ignore files whose :to_resource method returns nil" do
       @settings.setdefaults :main, :maindir => [@prefix+"/maindir", "a"]
       @settings.setting(:maindir).expects(:to_resource).returns nil
 
       Puppet::Resource::Catalog.any_instance.expects(:add_resource).never
       @settings.to_catalog
     end
 
+    describe "on Microsoft Windows" do
+      before :each do
+        Puppet.features.stubs(:root?).returns true
+        Puppet.features.stubs(:microsoft_windows?).returns true
+
+        @settings.setdefaults :foo, :mkusers => [true, "e"], :user => ["suser", "doc"], :group => ["sgroup", "doc"]
+        @settings.setdefaults :other, :otherdir => {:default => "/otherdir", :desc => "a", :owner => "service", :group => "service"}
+
+        @catalog = @settings.to_catalog
+      end
+
+      it "it should not add users and groups to the catalog" do
+        @catalog.resource(:user, "suser").should be_nil
+        @catalog.resource(:group, "sgroup").should be_nil
+      end
+    end
+
     describe "when adding users and groups to the catalog" do
       before do
         Puppet.features.stubs(:root?).returns true
+        Puppet.features.stubs(:microsoft_windows?).returns false
+
         @settings.setdefaults :foo, :mkusers => [true, "e"], :user => ["suser", "doc"], :group => ["sgroup", "doc"]
         @settings.setdefaults :other, :otherdir => {:default => "/otherdir", :desc => "a", :owner => "service", :group => "service"}
 
         @catalog = @settings.to_catalog
       end
 
       it "should add each specified user and group to the catalog if :mkusers is a valid setting, is enabled, and we're running as root" do
         @catalog.resource(:user, "suser").should be_instance_of(Puppet::Resource)
         @catalog.resource(:group, "sgroup").should be_instance_of(Puppet::Resource)
       end
 
       it "should only add users and groups to the catalog from specified sections" do
         @settings.setdefaults :yay, :yaydir => {:default => "/yaydir", :desc => "a", :owner => "service", :group => "service"}
         catalog = @settings.to_catalog(:other)
         catalog.resource(:user, "jane").should be_nil
         catalog.resource(:group, "billy").should be_nil
       end
 
       it "should not add users or groups to the catalog if :mkusers not running as root" do
         Puppet.features.stubs(:root?).returns false
 
         catalog = @settings.to_catalog
         catalog.resource(:user, "suser").should be_nil
         catalog.resource(:group, "sgroup").should be_nil
       end
 
       it "should not add users or groups to the catalog if :mkusers is not a valid setting" do
         Puppet.features.stubs(:root?).returns true
         settings = Puppet::Util::Settings.new
         settings.setdefaults :other, :otherdir => {:default => "/otherdir", :desc => "a", :owner => "service", :group => "service"}
 
         catalog = settings.to_catalog
         catalog.resource(:user, "suser").should be_nil
         catalog.resource(:group, "sgroup").should be_nil
       end
 
       it "should not add users or groups to the catalog if :mkusers is a valid setting but is disabled" do
         @settings[:mkusers] = false
 
         catalog = @settings.to_catalog
         catalog.resource(:user, "suser").should be_nil
         catalog.resource(:group, "sgroup").should be_nil
       end
 
       it "should not try to add users or groups to the catalog twice" do
         @settings.setdefaults :yay, :yaydir => {:default => "/yaydir", :desc => "a", :owner => "service", :group => "service"}
 
         # This would fail if users/groups were added twice
         lambda { @settings.to_catalog }.should_not raise_error
       end
 
       it "should set :ensure to :present on each created user and group" do
         @catalog.resource(:user, "suser")[:ensure].should == :present
         @catalog.resource(:group, "sgroup")[:ensure].should == :present
       end
 
       it "should set each created user's :gid to the service group" do
         @settings.to_catalog.resource(:user, "suser")[:gid].should == "sgroup"
       end
 
       it "should not attempt to manage the root user" do
         Puppet.features.stubs(:root?).returns true
         @settings.setdefaults :foo, :foodir => {:default => "/foodir", :desc => "a", :owner => "root", :group => "service"}
 
         @settings.to_catalog.resource(:user, "root").should be_nil
       end
     end
   end
 
   it "should be able to be converted to a manifest" do
     Puppet::Util::Settings.new.should respond_to(:to_manifest)
   end
 
   describe "when being converted to a manifest" do
     it "should produce a string with the code for each resource joined by two carriage returns" do
       @settings = Puppet::Util::Settings.new
       @settings.setdefaults :main, :maindir => ["/maindir", "a"], :seconddir => ["/seconddir", "a"]
 
       main = stub 'main_resource', :ref => "File[/maindir]"
       main.expects(:to_manifest).returns "maindir"
       second = stub 'second_resource', :ref => "File[/seconddir]"
       second.expects(:to_manifest).returns "seconddir"
       @settings.setting(:maindir).expects(:to_resource).returns main
       @settings.setting(:seconddir).expects(:to_resource).returns second
 
       @settings.to_manifest.split("\n\n").sort.should == %w{maindir seconddir}
     end
   end
 
   describe "when using sections of the configuration to manage the local host" do
     before do
       @settings = Puppet::Util::Settings.new
       @settings.stubs(:service_user_available?).returns true
       @settings.setdefaults :main, :noop => [false, ""]
       @settings.setdefaults :main, :maindir => ["/maindir", "a"], :seconddir => ["/seconddir", "a"]
       @settings.setdefaults :main, :user => ["suser", "doc"], :group => ["sgroup", "doc"]
       @settings.setdefaults :other, :otherdir => {:default => "/otherdir", :desc => "a", :owner => "service", :group => "service", :mode => 0755}
       @settings.setdefaults :third, :thirddir => ["/thirddir", "b"]
       @settings.setdefaults :files, :myfile => {:default => "/myfile", :desc => "a", :mode => 0755}
     end
 
     it "should provide a method that writes files with the correct modes" do
       @settings.should respond_to(:write)
     end
 
     it "should provide a method that creates directories with the correct modes" do
       Puppet::Util::SUIDManager.expects(:asuser).with("suser", "sgroup").yields
       Dir.expects(:mkdir).with("/otherdir", 0755)
       @settings.mkdir(:otherdir)
     end
 
     it "should create a catalog with the specified sections" do
       @settings.expects(:to_catalog).with(:main, :other).returns Puppet::Resource::Catalog.new("foo")
       @settings.use(:main, :other)
     end
 
     it "should canonicalize the sections" do
       @settings.expects(:to_catalog).with(:main, :other).returns Puppet::Resource::Catalog.new("foo")
       @settings.use("main", "other")
     end
 
     it "should ignore sections that have already been used" do
       @settings.expects(:to_catalog).with(:main).returns Puppet::Resource::Catalog.new("foo")
       @settings.use(:main)
       @settings.expects(:to_catalog).with(:other).returns Puppet::Resource::Catalog.new("foo")
       @settings.use(:main, :other)
     end
 
     it "should ignore tags and schedules when creating files and directories"
 
     it "should be able to provide all of its parameters in a format compatible with GetOpt::Long" do
       pending "Not converted from test/unit yet"
     end
 
     it "should convert the created catalog to a RAL catalog" do
       @catalog = Puppet::Resource::Catalog.new("foo")
       @settings.expects(:to_catalog).with(:main).returns @catalog
 
       @catalog.expects(:to_ral).returns @catalog
       @settings.use(:main)
     end
 
     it "should specify that it is not managing a host catalog" do
       catalog = Puppet::Resource::Catalog.new("foo")
       catalog.expects(:apply)
       @settings.expects(:to_catalog).returns catalog
 
       catalog.stubs(:to_ral).returns catalog
 
       catalog.expects(:host_config=).with false
 
       @settings.use(:main)
     end
 
     it "should support a method for re-using all currently used sections" do
       @settings.expects(:to_catalog).with(:main, :third).times(2).returns Puppet::Resource::Catalog.new("foo")
 
       @settings.use(:main, :third)
       @settings.reuse
     end
 
     it "should fail with an appropriate message if any resources fail" do
       @catalog = Puppet::Resource::Catalog.new("foo")
       @catalog.stubs(:to_ral).returns @catalog
       @settings.expects(:to_catalog).returns @catalog
 
       @trans = mock("transaction")
       @catalog.expects(:apply).yields(@trans)
 
       @trans.expects(:any_failed?).returns(true)
 
       report = mock 'report'
       @trans.expects(:report).returns report
 
       log = mock 'log', :to_s => "My failure", :level => :err
       report.expects(:logs).returns [log]
 
       @settings.expects(:raise).with { |msg| msg.include?("My failure") }
       @settings.use(:whatever)
     end
   end
 
   describe "when dealing with printing configs" do
     before do
       @settings = Puppet::Util::Settings.new
       #these are the magic default values
       @settings.stubs(:value).with(:configprint).returns("")
       @settings.stubs(:value).with(:genconfig).returns(false)
       @settings.stubs(:value).with(:genmanifest).returns(false)
       @settings.stubs(:value).with(:environment).returns(nil)
     end
 
     describe "when checking print_config?" do
       it "should return false when the :configprint, :genconfig and :genmanifest are not set" do
         @settings.print_configs?.should be_false
       end
 
       it "should return true when :configprint has a value" do
         @settings.stubs(:value).with(:configprint).returns("something")
         @settings.print_configs?.should be_true
       end
 
       it "should return true when :genconfig has a value" do
         @settings.stubs(:value).with(:genconfig).returns(true)
         @settings.print_configs?.should be_true
       end
 
       it "should return true when :genmanifest has a value" do
         @settings.stubs(:value).with(:genmanifest).returns(true)
         @settings.print_configs?.should be_true
       end
     end
 
     describe "when printing configs" do
       describe "when :configprint has a value" do
         it "should call print_config_options" do
           @settings.stubs(:value).with(:configprint).returns("something")
           @settings.expects(:print_config_options)
           @settings.print_configs
         end
 
         it "should get the value of the option using the environment" do
           @settings.stubs(:value).with(:configprint).returns("something")
           @settings.stubs(:include?).with("something").returns(true)
           @settings.expects(:value).with(:environment).returns("env")
           @settings.expects(:value).with("something", "env").returns("foo")
           @settings.stubs(:puts).with("foo")
           @settings.print_configs
         end
 
         it "should print the value of the option" do
           @settings.stubs(:value).with(:configprint).returns("something")
           @settings.stubs(:include?).with("something").returns(true)
           @settings.stubs(:value).with("something", nil).returns("foo")
           @settings.expects(:puts).with("foo")
           @settings.print_configs
         end
 
         it "should print the value pairs if there are multiple options" do
           @settings.stubs(:value).with(:configprint).returns("bar,baz")
           @settings.stubs(:include?).with("bar").returns(true)
           @settings.stubs(:include?).with("baz").returns(true)
           @settings.stubs(:value).with("bar", nil).returns("foo")
           @settings.stubs(:value).with("baz", nil).returns("fud")
           @settings.expects(:puts).with("bar = foo")
           @settings.expects(:puts).with("baz = fud")
           @settings.print_configs
         end
 
         it "should print a whole bunch of stuff if :configprint = all"
 
         it "should return true after printing" do
           @settings.stubs(:value).with(:configprint).returns("something")
           @settings.stubs(:include?).with("something").returns(true)
           @settings.stubs(:value).with("something", nil).returns("foo")
           @settings.stubs(:puts).with("foo")
           @settings.print_configs.should be_true
         end
 
         it "should return false if a config param is not found" do
           @settings.stubs :puts
           @settings.stubs(:value).with(:configprint).returns("something")
           @settings.stubs(:include?).with("something").returns(false)
           @settings.print_configs.should be_false
         end
       end
 
       describe "when genconfig is true" do
         before do
           @settings.stubs :puts
         end
 
         it "should call to_config" do
           @settings.stubs(:value).with(:genconfig).returns(true)
           @settings.expects(:to_config)
           @settings.print_configs
         end
 
         it "should return true from print_configs" do
           @settings.stubs(:value).with(:genconfig).returns(true)
           @settings.stubs(:to_config)
           @settings.print_configs.should be_true
         end
       end
 
       describe "when genmanifest is true" do
         before do
           @settings.stubs :puts
         end
 
         it "should call to_config" do
           @settings.stubs(:value).with(:genmanifest).returns(true)
           @settings.expects(:to_manifest)
           @settings.print_configs
         end
 
         it "should return true from print_configs" do
           @settings.stubs(:value).with(:genmanifest).returns(true)
           @settings.stubs(:to_manifest)
           @settings.print_configs.should be_true
         end
       end
     end
   end
 
   describe "when setting a timer to trigger configuration file reparsing" do
     before do
       @settings = Puppet::Util::Settings.new
       @settings.setdefaults :foo, :filetimeout => [5, "eh"]
     end
 
     it "should do nothing if no filetimeout setting is available" do
       @settings.expects(:value).with(:filetimeout).returns nil
       EventLoop::Timer.expects(:new).never
       @settings.set_filetimeout_timer
     end
 
     it "should always convert the timer interval to an integer" do
       @settings.expects(:value).with(:filetimeout).returns "10"
       EventLoop::Timer.expects(:new).with(:interval => 10, :start? => true, :tolerance => 1)
       @settings.set_filetimeout_timer
     end
 
     it "should do nothing if the filetimeout setting is not greater than 0" do
       @settings.expects(:value).with(:filetimeout).returns -2
       EventLoop::Timer.expects(:new).never
       @settings.set_filetimeout_timer
     end
 
     it "should create a timer with its interval set to the filetimeout, start? set to true, and a tolerance of 1" do
       @settings.expects(:value).with(:filetimeout).returns 5
       EventLoop::Timer.expects(:new).with(:interval => 5, :start? => true, :tolerance => 1)
 
       @settings.set_filetimeout_timer
     end
 
     it "should reparse when the timer goes off" do
       EventLoop::Timer.expects(:new).with(:interval => 5, :start? => true, :tolerance => 1).yields
 
       @settings.expects(:reparse)
 
       @settings.set_filetimeout_timer
     end
   end
 
   describe "when determining if the service user is available" do
     it "should return false if there is no user setting" do
       Puppet::Util::Settings.new.should_not be_service_user_available
     end
 
     it "should return false if the user provider says the user is missing" do
       settings = Puppet::Util::Settings.new
       settings.setdefaults :main, :user => ["foo", "doc"]
 
       user = mock 'user'
       user.expects(:exists?).returns false
 
       Puppet::Type.type(:user).expects(:new).with { |args| args[:name] == "foo" }.returns user
 
       settings.should_not be_service_user_available
     end
 
     it "should return true if the user provider says the user is present" do
       settings = Puppet::Util::Settings.new
       settings.setdefaults :main, :user => ["foo", "doc"]
 
       user = mock 'user'
       user.expects(:exists?).returns true
 
       Puppet::Type.type(:user).expects(:new).with { |args| args[:name] == "foo" }.returns user
 
       settings.should be_service_user_available
     end
 
     it "should cache the result"
   end
 
   describe "#writesub" do
     it "should only pass valid arguments to File.open" do
       settings = Puppet::Util::Settings.new
       settings.stubs(:get_config_file_default).with(:privatekeydir).returns(OpenStruct.new(:mode => "750"))
 
       File.expects(:open).with("/path/to/keydir", "w", 750).returns true
       settings.writesub(:privatekeydir, "/path/to/keydir")
     end
   end
 end
diff --git a/spec/unit/util/suidmanager_spec.rb b/spec/unit/util/suidmanager_spec.rb
index abfe3f723..474d0b2a2 100755
--- a/spec/unit/util/suidmanager_spec.rb
+++ b/spec/unit/util/suidmanager_spec.rb
@@ -1,213 +1,302 @@
 #!/usr/bin/env rspec
 
 require 'spec_helper'
 
 describe Puppet::Util::SUIDManager do
   let :user do
     Puppet::Type.type(:user).new(:name => 'name', :uid => 42, :gid => 42)
   end
 
   let :xids do
     Hash.new {|h,k| 0}
   end
 
   before :each do
     Puppet::Util::SUIDManager.stubs(:convert_xid).returns(42)
     Puppet::Util::SUIDManager.stubs(:initgroups)
 
     [:euid, :egid, :uid, :gid, :groups].each do |id|
       Process.stubs("#{id}=").with {|value| xids[id] = value}
     end
   end
 
   describe "#uid" do
     it "should allow setting euid/egid" do
       Puppet::Util::SUIDManager.egid = user[:gid]
       Puppet::Util::SUIDManager.euid = user[:uid]
 
       xids[:egid].should == user[:gid]
       xids[:euid].should == user[:uid]
     end
   end
 
   describe "#asuser" do
     it "should set euid/egid when root" do
       Process.stubs(:uid).returns(0)
       Puppet.features.stubs(:microsoft_windows?).returns(false)
 
       Process.stubs(:egid).returns(51)
       Process.stubs(:euid).returns(50)
 
       Puppet::Util::SUIDManager.stubs(:convert_xid).with(:gid, 51).returns(51)
       Puppet::Util::SUIDManager.stubs(:convert_xid).with(:uid, 50).returns(50)
 
       yielded = false
       Puppet::Util::SUIDManager.asuser(user[:uid], user[:gid]) do
         xids[:egid].should == user[:gid]
         xids[:euid].should == user[:uid]
         yielded = true
       end
 
       xids[:egid].should == 51
       xids[:euid].should == 50
 
       # It's possible asuser could simply not yield, so the assertions in the
       # block wouldn't fail. So verify those actually got checked.
       yielded.should be_true
     end
 
     it "should not get or set euid/egid when not root" do
       Process.stubs(:uid).returns(1)
 
       Process.stubs(:egid).returns(51)
       Process.stubs(:euid).returns(50)
 
       Puppet::Util::SUIDManager.asuser(user[:uid], user[:gid]) {}
 
       xids.should be_empty
     end
+
+    it "should not get or set euid/egid on Windows" do
+      Puppet.features.stubs(:microsoft_windows?).returns true
+
+      Puppet::Util::SUIDManager.asuser(user[:uid], user[:gid]) {}
+
+      xids.should be_empty
+    end
   end
 
   describe "#change_group" do
     describe "when changing permanently" do
       it "should try to change_privilege if it is supported" do
         Process::GID.expects(:change_privilege).with do |gid|
           Process.gid = gid
           Process.egid = gid
         end
 
         Puppet::Util::SUIDManager.change_group(42, true)
 
         xids[:egid].should == 42
         xids[:gid].should == 42
       end
 
       it "should change both egid and gid if change_privilege isn't supported" do
         Process::GID.stubs(:change_privilege).raises(NotImplementedError)
 
         Puppet::Util::SUIDManager.change_group(42, true)
 
         xids[:egid].should == 42
         xids[:gid].should == 42
       end
     end
 
     describe "when changing temporarily" do
       it "should change only egid" do
         Puppet::Util::SUIDManager.change_group(42, false)
 
         xids[:egid].should == 42
         xids[:gid].should == 0
       end
     end
   end
 
   describe "#change_user" do
     describe "when changing permanently" do
       it "should try to change_privilege if it is supported" do
         Process::UID.expects(:change_privilege).with do |uid|
           Process.uid = uid
           Process.euid = uid
         end
 
         Puppet::Util::SUIDManager.change_user(42, true)
 
         xids[:euid].should == 42
         xids[:uid].should == 42
       end
 
       it "should change euid and uid and groups if change_privilege isn't supported" do
         Process::UID.stubs(:change_privilege).raises(NotImplementedError)
 
         Puppet::Util::SUIDManager.expects(:initgroups).with(42)
 
         Puppet::Util::SUIDManager.change_user(42, true)
 
         xids[:euid].should == 42
         xids[:uid].should == 42
       end
     end
 
     describe "when changing temporarily" do
       it "should change only euid and groups" do
         Puppet::Util::SUIDManager.change_user(42, false)
 
         xids[:euid].should == 42
         xids[:uid].should == 0
       end
 
       it "should set euid before groups if changing to root" do
         Process.stubs(:euid).returns 50
 
         when_not_root = sequence 'when_not_root'
 
         Process.expects(:euid=).in_sequence(when_not_root)
         Puppet::Util::SUIDManager.expects(:initgroups).in_sequence(when_not_root)
 
         Puppet::Util::SUIDManager.change_user(0, false)
       end
 
       it "should set groups before euid if changing from root" do
         Process.stubs(:euid).returns 0
 
         when_root = sequence 'when_root'
 
         Puppet::Util::SUIDManager.expects(:initgroups).in_sequence(when_root)
         Process.expects(:euid=).in_sequence(when_root)
 
         Puppet::Util::SUIDManager.change_user(50, false)
       end
     end
   end
 
   describe "when running commands" do
     before :each do
       # We want to make sure $CHILD_STATUS is set
       Kernel.system '' if $CHILD_STATUS.nil?
     end
 
     describe "with #system" do
       it "should set euid/egid when root" do
         Process.stubs(:uid).returns(0)
         Puppet.features.stubs(:microsoft_windows?).returns(false)
 
         Process.stubs(:egid).returns(51)
         Process.stubs(:euid).returns(50)
 
         Puppet::Util::SUIDManager.stubs(:convert_xid).with(:gid, 51).returns(51)
         Puppet::Util::SUIDManager.stubs(:convert_xid).with(:uid, 50).returns(50)
 
         Puppet::Util::SUIDManager.expects(:change_group).with(user[:uid])
         Puppet::Util::SUIDManager.expects(:change_user).with(user[:uid])
 
         Puppet::Util::SUIDManager.expects(:change_group).with(51)
         Puppet::Util::SUIDManager.expects(:change_user).with(50)
 
         Kernel.expects(:system).with('blah')
         Puppet::Util::SUIDManager.system('blah', user[:uid], user[:gid])
       end
 
       it "should not get or set euid/egid when not root" do
         Process.stubs(:uid).returns(1)
         Kernel.expects(:system).with('blah')
 
         Puppet::Util::SUIDManager.system('blah', user[:uid], user[:gid])
 
         xids.should be_empty
       end
+
+      it "should not get or set euid/egid on Windows" do
+        Puppet.features.stubs(:microsoft_windows?).returns true
+        Kernel.expects(:system).with('blah')
+
+        Puppet::Util::SUIDManager.system('blah', user[:uid], user[:gid])
+
+        xids.should be_empty
+      end
     end
 
     describe "with #run_and_capture" do
       it "should capture the output and return process status" do
         Puppet::Util.
           expects(:execute).
           with('yay', :combine => true, :failonfail => false, :uid => user[:uid], :gid => user[:gid]).
           returns('output')
         output = Puppet::Util::SUIDManager.run_and_capture 'yay', user[:uid], user[:gid]
 
         output.first.should == 'output'
         output.last.should be_a(Process::Status)
       end
     end
   end
+
+  describe "#root?" do
+    describe "on POSIX systems" do
+      before :each do
+        Puppet.features.stubs(:posix?).returns(true)
+        Puppet.features.stubs(:microsoft_windows?).returns(false)
+      end
+
+      it "should be root if uid is 0" do
+        Process.stubs(:uid).returns(0)
+
+        Puppet::Util::SUIDManager.should be_root
+      end
+
+      it "should not be root if uid is not 0" do
+        Process.stubs(:uid).returns(1)
+
+        Puppet::Util::SUIDManager.should_not be_root
+      end
+    end
+
+    describe "on Microsoft Windows", :if => Puppet.features.microsoft_windows? do
+      describe "2003 without UAC" do
+        it "should be root if user is a member of the Administrators group" do
+          Win32::Security.stubs(:elevated_security?).raises(Win32::Security::Error, "Incorrect function.")
+          Sys::Admin.stubs(:get_login).returns("Administrator")
+          Sys::Group.stubs(:members).returns(%w[Administrator])
+
+          Puppet::Util::SUIDManager.should be_root
+        end
+
+        it "should not be root if the process is running as Guest" do
+          Win32::Security.stubs(:elevated_security?).raises(Win32::Security::Error, "Incorrect function.")
+          Sys::Admin.stubs(:get_login).returns("Guest")
+          Sys::Group.stubs(:members).returns([])
+
+          Puppet::Util::SUIDManager.should_not be_root
+        end
+
+        it "should raise an exception if the process fails to open the process token" do
+          Win32::Security.stubs(:elevated_security?).raises(Win32::Security::Error, "Access denied.")
+          Sys::Admin.stubs(:get_login).returns("Administrator")
+          Sys::Group.expects(:members).never
+
+          lambda { Puppet::Util::SUIDManager.should raise_error(Win32::Security::Error, /Access denied./) }
+        end
+      end
+
+      describe "2008 with UAC" do
+        it "should be root if user is running with elevated privileges" do
+          Win32::Security.stubs(:elevated_security?).returns(true)
+          Sys::Admin.expects(:get_login).never
+
+          Puppet::Util::SUIDManager.should be_root
+        end
+
+        it "should not be root if user is not running with elevated privileges" do
+          Win32::Security.stubs(:elevated_security?).returns(false)
+          Sys::Admin.expects(:get_login).never
+
+          Puppet::Util::SUIDManager.should_not be_root
+        end
+
+        it "should raise an exception if the process fails to open the process token" do
+          Win32::Security.stubs(:elevated_security?).raises(Win32::Security::Error, "Access denied.")
+          Sys::Admin.expects(:get_login).never
+
+          lambda { Puppet::Util::SUIDManager.should raise_error(Win32::Security::Error, /Access denied./) }
+        end
+      end
+    end
+  end
 end