diff --git a/lib/puppet/provider/file/windows.rb b/lib/puppet/provider/file/windows.rb
index c0ef68cd9..ea4372be5 100644
--- a/lib/puppet/provider/file/windows.rb
+++ b/lib/puppet/provider/file/windows.rb
@@ -1,104 +1,104 @@
 Puppet::Type.type(:file).provide :windows do
   desc "Uses Microsoft Windows functionality to manage file ownership and permissions."
 
   confine :operatingsystem => :windows
   has_feature :manages_symlinks if Puppet.features.manages_symlinks?
 
   include Puppet::Util::Warnings
 
   if Puppet.features.microsoft_windows?
     require 'puppet/util/windows'
     include Puppet::Util::Windows::Security
   end
 
   # Determine if the account is valid, and if so, return the UID
   def name2id(value)
     Puppet::Util::Windows::SID.name_to_sid(value)
   end
 
   # If it's a valid SID, get the name. Otherwise, it's already a name,
   # so just return it.
   def id2name(id)
     if Puppet::Util::Windows::SID.valid_sid?(id)
       Puppet::Util::Windows::SID.sid_to_name(id)
     else
       id
     end
   end
 
   # We use users and groups interchangeably, so use the same methods for both
   # (the type expects different methods, so we have to oblige).
   alias :uid2name :id2name
   alias :gid2name :id2name
 
   alias :name2gid :name2id
   alias :name2uid :name2id
 
   def owner
     return :absent unless resource.stat
     get_owner(resource[:path])
   end
 
   def owner=(should)
     begin
       set_owner(should, resolved_path)
     rescue => detail
       raise Puppet::Error, "Failed to set owner to '#{should}': #{detail}", detail.backtrace
     end
   end
 
   def group
     return :absent unless resource.stat
     get_group(resource[:path])
   end
 
   def group=(should)
     begin
       set_group(should, resolved_path)
     rescue => detail
       raise Puppet::Error, "Failed to set group to '#{should}': #{detail}", detail.backtrace
     end
   end
 
   def mode
     if resource.stat
       mode = get_mode(resource[:path])
-      mode ? mode.to_s(8) : :absent
+      mode ? mode.to_s(8).rjust(4, '0') : :absent
     else
       :absent
     end
   end
 
   def mode=(value)
     begin
       set_mode(value.to_i(8), resource[:path])
     rescue => detail
       error = Puppet::Error.new("failed to set mode #{mode} on #{resource[:path]}: #{detail.message}")
       error.set_backtrace detail.backtrace
       raise error
     end
     :file_changed
   end
 
   def validate
     if [:owner, :group, :mode].any?{|p| resource[p]} and !supports_acl?(resource[:path])
       resource.fail("Can only manage owner, group, and mode on filesystems that support Windows ACLs, such as NTFS")
     end
   end
 
   attr_reader :file
   private
   def file
     @file ||= Puppet::FileSystem.pathname(resource[:path])
   end
 
   def resolved_path
     path = file()
     # under POSIX, :manage means use lchown - i.e. operate on the link
     return path.to_s if resource[:links] == :manage
 
     # otherwise, use chown -- that will resolve the link IFF it is a link
     # otherwise it will operate on the path
     Puppet::FileSystem.symlink?(path) ? Puppet::FileSystem.readlink(path) : path.to_s
   end
 end
diff --git a/spec/unit/provider/file/windows_spec.rb b/spec/unit/provider/file/windows_spec.rb
index c114a9f7b..fb8aee9f7 100755
--- a/spec/unit/provider/file/windows_spec.rb
+++ b/spec/unit/provider/file/windows_spec.rb
@@ -1,154 +1,154 @@
 #! /usr/bin/env ruby
 
 require 'spec_helper'
 if Puppet.features.microsoft_windows?
   require 'puppet/util/windows'
   class WindowsSecurity
     extend Puppet::Util::Windows::Security
   end
 end
 
 describe Puppet::Type.type(:file).provider(:windows), :if => Puppet.features.microsoft_windows? do
   include PuppetSpec::Files
 
   let(:path) { tmpfile('windows_file_spec') }
   let(:resource) { Puppet::Type.type(:file).new :path => path, :mode => '0777', :provider => described_class.name }
   let(:provider) { resource.provider }
   let(:sid)      { 'S-1-1-50' }
   let(:account)  { 'quinn' }
 
   describe "#mode" do
-    it "should return a string with the higher-order bits stripped away" do
+    it "should return a string representing the mode in 4-digit octal notation" do
       FileUtils.touch(path)
       WindowsSecurity.set_mode(0644, path)
 
-      provider.mode.should == '644'
+      provider.mode.should == '0644'
     end
 
     it "should return absent if the file doesn't exist" do
       provider.mode.should == :absent
     end
   end
 
   describe "#mode=" do
     it "should chmod the file to the specified value" do
       FileUtils.touch(path)
       WindowsSecurity.set_mode(0644, path)
 
       provider.mode = '0755'
 
-      provider.mode.should == '755'
+      provider.mode.should == '0755'
     end
 
     it "should pass along any errors encountered" do
       expect do
-        provider.mode = '644'
+        provider.mode = '0644'
       end.to raise_error(Puppet::Error, /failed to set mode/)
     end
   end
 
   describe "#id2name" do
     it "should return the name of the user identified by the sid" do
       Puppet::Util::Windows::SID.expects(:valid_sid?).with(sid).returns(true)
       Puppet::Util::Windows::SID.expects(:sid_to_name).with(sid).returns(account)
 
       provider.id2name(sid).should == account
     end
 
     it "should return the argument if it's already a name" do
       Puppet::Util::Windows::SID.expects(:valid_sid?).with(account).returns(false)
       Puppet::Util::Windows::SID.expects(:sid_to_name).never
 
       provider.id2name(account).should == account
     end
 
     it "should return nil if the user doesn't exist" do
       Puppet::Util::Windows::SID.expects(:valid_sid?).with(sid).returns(true)
       Puppet::Util::Windows::SID.expects(:sid_to_name).with(sid).returns(nil)
 
       provider.id2name(sid).should == nil
     end
   end
 
   describe "#name2id" do
     it "should delegate to name_to_sid" do
       Puppet::Util::Windows::SID.expects(:name_to_sid).with(account).returns(sid)
 
       provider.name2id(account).should == sid
     end
   end
 
   describe "#owner" do
     it "should return the sid of the owner if the file does exist" do
       FileUtils.touch(resource[:path])
       provider.stubs(:get_owner).with(resource[:path]).returns(sid)
 
       provider.owner.should == sid
     end
 
     it "should return absent if the file doesn't exist" do
       provider.owner.should == :absent
     end
   end
 
   describe "#owner=" do
     it "should set the owner to the specified value" do
       provider.expects(:set_owner).with(sid, resource[:path])
       provider.owner = sid
     end
 
     it "should propagate any errors encountered when setting the owner" do
       provider.stubs(:set_owner).raises(ArgumentError)
 
       expect {
         provider.owner = sid
       }.to raise_error(Puppet::Error, /Failed to set owner/)
     end
   end
 
   describe "#group" do
     it "should return the sid of the group if the file does exist" do
       FileUtils.touch(resource[:path])
       provider.stubs(:get_group).with(resource[:path]).returns(sid)
 
       provider.group.should == sid
     end
 
     it "should return absent if the file doesn't exist" do
       provider.group.should == :absent
     end
   end
 
   describe "#group=" do
     it "should set the group to the specified value" do
       provider.expects(:set_group).with(sid, resource[:path])
       provider.group = sid
     end
 
     it "should propagate any errors encountered when setting the group" do
       provider.stubs(:set_group).raises(ArgumentError)
 
       expect {
         provider.group = sid
       }.to raise_error(Puppet::Error, /Failed to set group/)
     end
   end
 
   describe "when validating" do
     {:owner => 'foo', :group => 'foo', :mode => '0777'}.each do |k,v|
       it "should fail if the filesystem doesn't support ACLs and we're managing #{k}" do
         described_class.any_instance.stubs(:supports_acl?).returns false
 
         expect {
           Puppet::Type.type(:file).new :path => path, k => v
         }.to raise_error(Puppet::Error, /Can only manage owner, group, and mode on filesystems that support Windows ACLs, such as NTFS/)
       end
     end
 
     it "should not fail if the filesystem doesn't support ACLs and we're not managing permissions" do
       described_class.any_instance.stubs(:supports_acl?).returns false
 
       Puppet::Type.type(:file).new :path => path
     end
   end
 end