diff --git a/lib/puppet/util/windows/adsi.rb b/lib/puppet/util/windows/adsi.rb
index f360c63b2..4335d3d99 100644
--- a/lib/puppet/util/windows/adsi.rb
+++ b/lib/puppet/util/windows/adsi.rb
@@ -1,392 +1,392 @@
 module Puppet::Util::Windows::ADSI
   require 'ffi'
 
   class << self
     extend FFI::Library
 
     def connectable?(uri)
       begin
         !! connect(uri)
       rescue
         false
       end
     end
 
     def connect(uri)
       begin
         WIN32OLE.connect(uri)
       rescue Exception => e
         raise Puppet::Error.new( "ADSI connection error: #{e}", e )
       end
     end
 
     def create(name, resource_type)
       Puppet::Util::Windows::ADSI.connect(computer_uri).Create(resource_type, name)
     end
 
     def delete(name, resource_type)
       Puppet::Util::Windows::ADSI.connect(computer_uri).Delete(resource_type, name)
     end
 
-    ffi_convention :stdcall
-
-    # http://msdn.microsoft.com/en-us/library/windows/desktop/ms724295(v=vs.85).aspx
-    # BOOL WINAPI GetComputerName(
-    #   _Out_    LPTSTR lpBuffer,
-    #   _Inout_  LPDWORD lpnSize
-    # );
-    ffi_lib :kernel32
-    attach_function_private :GetComputerNameW,
-      [:lpwstr, :lpdword], :win32_bool
-
     # taken from winbase.h
     MAX_COMPUTERNAME_LENGTH = 31
 
     def computer_name
       unless @computer_name
         max_length = MAX_COMPUTERNAME_LENGTH + 1 # NULL terminated
         buffer = FFI::MemoryPointer.new(max_length * 2) # wide string
         buffer_size = FFI::MemoryPointer.new(:dword, 1)
         buffer_size.write_dword(max_length) # length in TCHARs
 
         if GetComputerNameW(buffer, buffer_size) == FFI::WIN32_FALSE
           raise Puppet::Util::Windows::Error.new("Failed to get computer name")
         end
         @computer_name = buffer.read_wide_string(buffer_size.read_dword)
       end
       @computer_name
     end
 
     def computer_uri(host = '.')
       "WinNT://#{host}"
     end
 
     def wmi_resource_uri( host = '.' )
       "winmgmts:{impersonationLevel=impersonate}!//#{host}/root/cimv2"
     end
 
     # @api private
     def sid_uri_safe(sid)
       return sid_uri(sid) if sid.kind_of?(Win32::Security::SID)
 
       begin
         sid = Win32::Security::SID.new(Win32::Security::SID.string_to_sid(sid))
         sid_uri(sid)
       rescue Win32::Security::SID::Error
         return nil
       end
     end
 
     def sid_uri(sid)
       raise Puppet::Error.new( "Must use a valid SID object" ) if !sid.kind_of?(Win32::Security::SID)
       "WinNT://#{sid.to_s}"
     end
 
     def uri(resource_name, resource_type, host = '.')
       "#{computer_uri(host)}/#{resource_name},#{resource_type}"
     end
 
     def wmi_connection
       connect(wmi_resource_uri)
     end
 
     def execquery(query)
       wmi_connection.execquery(query)
     end
 
     def sid_for_account(name)
       Puppet.deprecation_warning "Puppet::Util::Windows::ADSI.sid_for_account is deprecated and will be removed in 3.0, use Puppet::Util::Windows::SID.name_to_sid instead."
 
       Puppet::Util::Windows::Security.name_to_sid(name)
     end
+
+    ffi_convention :stdcall
+
+    # http://msdn.microsoft.com/en-us/library/windows/desktop/ms724295(v=vs.85).aspx
+    # BOOL WINAPI GetComputerName(
+    #   _Out_    LPTSTR lpBuffer,
+    #   _Inout_  LPDWORD lpnSize
+    # );
+    ffi_lib :kernel32
+    attach_function_private :GetComputerNameW,
+      [:lpwstr, :lpdword], :win32_bool
   end
 
   class User
     extend Enumerable
 
     attr_accessor :native_user
     attr_reader :name, :sid
     def initialize(name, native_user = nil)
       @name = name
       @native_user = native_user
     end
 
     def self.parse_name(name)
       if name =~ /\//
         raise Puppet::Error.new( "Value must be in DOMAIN\\user style syntax" )
       end
 
       matches = name.scan(/((.*)\\)?(.*)/)
       domain = matches[0][1] || '.'
       account = matches[0][2]
 
       return account, domain
     end
 
     def native_user
       @native_user ||= Puppet::Util::Windows::ADSI.connect(self.class.uri(*self.class.parse_name(@name)))
     end
 
     def sid
       @sid ||= Puppet::Util::Windows::Security.octet_string_to_sid_object(native_user.objectSID)
     end
 
     def self.uri(name, host = '.')
       if sid_uri = Puppet::Util::Windows::ADSI.sid_uri_safe(name) then return sid_uri end
 
       host = '.' if ['NT AUTHORITY', 'BUILTIN', Socket.gethostname].include?(host)
 
       Puppet::Util::Windows::ADSI.uri(name, 'user', host)
     end
 
     def uri
       self.class.uri(sid.account, sid.domain)
     end
 
     def self.logon(name, password)
       Puppet::Util::Windows::User.password_is?(name, password)
     end
 
     def [](attribute)
       native_user.Get(attribute)
     end
 
     def []=(attribute, value)
       native_user.Put(attribute, value)
     end
 
     def commit
       begin
         native_user.SetInfo unless native_user.nil?
       rescue Exception => e
         raise Puppet::Error.new( "User update failed: #{e}", e )
       end
       self
     end
 
     def password_is?(password)
       self.class.logon(name, password)
     end
 
     def add_flag(flag_name, value)
       flag = native_user.Get(flag_name) rescue 0
 
       native_user.Put(flag_name, flag | value)
 
       commit
     end
 
     def password=(password)
       native_user.SetPassword(password)
       commit
       fADS_UF_DONT_EXPIRE_PASSWD = 0x10000
       add_flag("UserFlags", fADS_UF_DONT_EXPIRE_PASSWD)
     end
 
     def groups
       # WIN32OLE objects aren't enumerable, so no map
       groups = []
       native_user.Groups.each {|g| groups << g.Name} rescue nil
       groups
     end
 
     def add_to_groups(*group_names)
       group_names.each do |group_name|
         Puppet::Util::Windows::ADSI::Group.new(group_name).add_member_sids(sid)
       end
     end
     alias add_to_group add_to_groups
 
     def remove_from_groups(*group_names)
       group_names.each do |group_name|
         Puppet::Util::Windows::ADSI::Group.new(group_name).remove_member_sids(sid)
       end
     end
     alias remove_from_group remove_from_groups
 
     def set_groups(desired_groups, minimum = true)
       return if desired_groups.nil? or desired_groups.empty?
 
       desired_groups = desired_groups.split(',').map(&:strip)
 
       current_groups = self.groups
 
       # First we add the user to all the groups it should be in but isn't
       groups_to_add = desired_groups - current_groups
       add_to_groups(*groups_to_add)
 
       # Then we remove the user from all groups it is in but shouldn't be, if
       # that's been requested
       groups_to_remove = current_groups - desired_groups
       remove_from_groups(*groups_to_remove) unless minimum
     end
 
     def self.create(name)
       # Windows error 1379: The specified local group already exists.
       raise Puppet::Error.new( "Cannot create user if group '#{name}' exists." ) if Puppet::Util::Windows::ADSI::Group.exists? name
       new(name, Puppet::Util::Windows::ADSI.create(name, 'user'))
     end
 
     def self.exists?(name)
       Puppet::Util::Windows::ADSI::connectable?(User.uri(*User.parse_name(name)))
     end
 
     def self.delete(name)
       Puppet::Util::Windows::ADSI.delete(name, 'user')
     end
 
     def self.each(&block)
       wql = Puppet::Util::Windows::ADSI.execquery('select name from win32_useraccount where localaccount = "TRUE"')
 
       users = []
       wql.each do |u|
         users << new(u.name)
       end
 
       users.each(&block)
     end
   end
 
   class UserProfile
     def self.delete(sid)
       begin
         Puppet::Util::Windows::ADSI.wmi_connection.Delete("Win32_UserProfile.SID='#{sid}'")
       rescue => e
         # http://social.technet.microsoft.com/Forums/en/ITCG/thread/0f190051-ac96-4bf1-a47f-6b864bfacee5
         # Prior to Vista SP1, there's no builtin way to programmatically
         # delete user profiles (except for delprof.exe). So try to delete
         # but warn if we fail
         raise e unless e.message.include?('80041010')
 
         Puppet.warning "Cannot delete user profile for '#{sid}' prior to Vista SP1"
       end
     end
   end
 
   class Group
     extend Enumerable
 
     attr_accessor :native_group
     attr_reader :name
     def initialize(name, native_group = nil)
       @name = name
       @native_group = native_group
     end
 
     def uri
       self.class.uri(name)
     end
 
     def self.uri(name, host = '.')
       if sid_uri = Puppet::Util::Windows::ADSI.sid_uri_safe(name) then return sid_uri end
 
       Puppet::Util::Windows::ADSI.uri(name, 'group', host)
     end
 
     def native_group
       @native_group ||= Puppet::Util::Windows::ADSI.connect(uri)
     end
 
     def commit
       begin
         native_group.SetInfo unless native_group.nil?
       rescue Exception => e
         raise Puppet::Error.new( "Group update failed: #{e}", e )
       end
       self
     end
 
     def self.name_sid_hash(names)
       return [] if names.nil? or names.empty?
 
       sids = names.map do |name|
         sid = Puppet::Util::Windows::Security.name_to_sid_object(name)
         raise Puppet::Error.new( "Could not resolve username: #{name}" ) if !sid
         [sid.to_s, sid]
       end
 
       Hash[ sids ]
     end
 
     def add_members(*names)
       Puppet.deprecation_warning('Puppet::Util::Windows::ADSI::Group#add_members is deprecated; please use Puppet::Util::Windows::ADSI::Group#add_member_sids')
       sids = self.class.name_sid_hash(names)
       add_member_sids(*sids.values)
     end
     alias add_member add_members
 
     def remove_members(*names)
       Puppet.deprecation_warning('Puppet::Util::Windows::ADSI::Group#remove_members is deprecated; please use Puppet::Util::Windows::ADSI::Group#remove_member_sids')
       sids = self.class.name_sid_hash(names)
       remove_member_sids(*sids.values)
     end
     alias remove_member remove_members
 
     def add_member_sids(*sids)
       sids.each do |sid|
         native_group.Add(Puppet::Util::Windows::ADSI.sid_uri(sid))
       end
     end
 
     def remove_member_sids(*sids)
       sids.each do |sid|
         native_group.Remove(Puppet::Util::Windows::ADSI.sid_uri(sid))
       end
     end
 
     def members
       # WIN32OLE objects aren't enumerable, so no map
       members = []
       native_group.Members.each {|m| members << m.Name}
       members
     end
 
     def member_sids
       sids = []
       native_group.Members.each do |m|
         sids << Puppet::Util::Windows::Security.octet_string_to_sid_object(m.objectSID)
       end
       sids
     end
 
     def set_members(desired_members)
       return if desired_members.nil? or desired_members.empty?
 
       current_hash = Hash[ self.member_sids.map { |sid| [sid.to_s, sid] } ]
       desired_hash = self.class.name_sid_hash(desired_members)
 
       # First we add all missing members
       members_to_add = (desired_hash.keys - current_hash.keys).map { |sid| desired_hash[sid] }
       add_member_sids(*members_to_add)
 
       # Then we remove all extra members
       members_to_remove = (current_hash.keys - desired_hash.keys).map { |sid| current_hash[sid] }
       remove_member_sids(*members_to_remove)
     end
 
     def self.create(name)
       # Windows error 2224: The account already exists.
       raise Puppet::Error.new( "Cannot create group if user '#{name}' exists." ) if Puppet::Util::Windows::ADSI::User.exists? name
       new(name, Puppet::Util::Windows::ADSI.create(name, 'group'))
     end
 
     def self.exists?(name)
       Puppet::Util::Windows::ADSI.connectable?(Group.uri(name))
     end
 
     def self.delete(name)
       Puppet::Util::Windows::ADSI.delete(name, 'group')
     end
 
     def self.each(&block)
       wql = Puppet::Util::Windows::ADSI.execquery( 'select name from win32_group where localaccount = "TRUE"' )
 
       groups = []
       wql.each do |g|
         groups << new(g.name)
       end
 
       groups.each(&block)
     end
   end
 end
diff --git a/lib/puppet/util/windows/file.rb b/lib/puppet/util/windows/file.rb
index 6c9a9b5fa..7998f7521 100644
--- a/lib/puppet/util/windows/file.rb
+++ b/lib/puppet/util/windows/file.rb
@@ -1,294 +1,294 @@
 require 'puppet/util/windows'
 
 module Puppet::Util::Windows::File
   require 'ffi'
   extend FFI::Library
   extend Puppet::Util::Windows::String
 
   def replace_file(target, source)
     target_encoded = wide_string(target.to_s)
     source_encoded = wide_string(source.to_s)
 
     flags = 0x1
     backup_file = nil
     result = ReplaceFileW(
       target_encoded,
       source_encoded,
       backup_file,
       flags,
       FFI::Pointer::NULL,
       FFI::Pointer::NULL
     )
 
     return true if result != FFI::WIN32_FALSE
     raise Puppet::Util::Windows::Error.new("ReplaceFile(#{target}, #{source})")
   end
   module_function :replace_file
 
   def move_file_ex(source, target, flags = 0)
     result = MoveFileExW(wide_string(source.to_s),
                          wide_string(target.to_s),
                          flags)
 
     return true if result != FFI::WIN32_FALSE
     raise Puppet::Util::Windows::Error.
       new("MoveFileEx(#{source}, #{target}, #{flags.to_s(8)})")
   end
   module_function :move_file_ex
 
-  ffi_convention :stdcall
-
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa365512(v=vs.85).aspx
-  # BOOL WINAPI ReplaceFile(
-  #   _In_        LPCTSTR lpReplacedFileName,
-  #   _In_        LPCTSTR lpReplacementFileName,
-  #   _In_opt_    LPCTSTR lpBackupFileName,
-  #   _In_        DWORD dwReplaceFlags - 0x1 REPLACEFILE_WRITE_THROUGH,
-  #                                      0x2 REPLACEFILE_IGNORE_MERGE_ERRORS,
-  #                                      0x4 REPLACEFILE_IGNORE_ACL_ERRORS
-  #   _Reserved_  LPVOID lpExclude,
-  #   _Reserved_  LPVOID lpReserved
-  # );
-  ffi_lib 'kernel32'
-  attach_function_private :ReplaceFileW,
-    [:lpcwstr, :lpcwstr, :lpcwstr, :dword, :lpvoid, :lpvoid], :win32_bool
-
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa365240(v=vs.85).aspx
-  # BOOL WINAPI MoveFileEx(
-  #   _In_      LPCTSTR lpExistingFileName,
-  #   _In_opt_  LPCTSTR lpNewFileName,
-  #   _In_      DWORD dwFlags
-  # );
-  ffi_lib 'kernel32'
-  attach_function_private :MoveFileExW,
-    [:lpcwstr, :lpcwstr, :dword], :win32_bool
-
-  # BOOLEAN WINAPI CreateSymbolicLink(
-  #   _In_  LPTSTR lpSymlinkFileName, - symbolic link to be created
-  #   _In_  LPTSTR lpTargetFileName, - name of target for symbolic link
-  #   _In_  DWORD dwFlags - 0x0 target is a file, 0x1 target is a directory
-  # );
-  # rescue on Windows < 6.0 so that code doesn't explode
-  begin
-    ffi_lib 'kernel32'
-    attach_function_private :CreateSymbolicLinkW,
-      [:lpwstr, :lpwstr, :dword], :win32_bool
-  rescue LoadError
-  end
-
-  # DWORD WINAPI GetFileAttributes(
-  #   _In_  LPCTSTR lpFileName
-  # );
-  ffi_lib 'kernel32'
-  attach_function_private :GetFileAttributesW,
-    [:lpcwstr], :dword
-
-  # HANDLE WINAPI CreateFile(
-  #   _In_      LPCTSTR lpFileName,
-  #   _In_      DWORD dwDesiredAccess,
-  #   _In_      DWORD dwShareMode,
-  #   _In_opt_  LPSECURITY_ATTRIBUTES lpSecurityAttributes,
-  #   _In_      DWORD dwCreationDisposition,
-  #   _In_      DWORD dwFlagsAndAttributes,
-  #   _In_opt_  HANDLE hTemplateFile
-  # );
-  ffi_lib 'kernel32'
-  attach_function_private :CreateFileW,
-    [:lpcwstr, :dword, :dword, :pointer, :dword, :dword, :handle], :handle
-
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa363216(v=vs.85).aspx
-  # BOOL WINAPI DeviceIoControl(
-  #   _In_         HANDLE hDevice,
-  #   _In_         DWORD dwIoControlCode,
-  #   _In_opt_     LPVOID lpInBuffer,
-  #   _In_         DWORD nInBufferSize,
-  #   _Out_opt_    LPVOID lpOutBuffer,
-  #   _In_         DWORD nOutBufferSize,
-  #   _Out_opt_    LPDWORD lpBytesReturned,
-  #   _Inout_opt_  LPOVERLAPPED lpOverlapped
-  # );
-  ffi_lib 'kernel32'
-  attach_function_private :DeviceIoControl,
-    [:handle, :dword, :lpvoid, :dword, :lpvoid, :dword, :lpdword, :pointer], :win32_bool
-
-  MAXIMUM_REPARSE_DATA_BUFFER_SIZE = 16384
-
-  # REPARSE_DATA_BUFFER
-  # http://msdn.microsoft.com/en-us/library/cc232006.aspx
-  # http://msdn.microsoft.com/en-us/library/windows/hardware/ff552012(v=vs.85).aspx
-  # struct is always MAXIMUM_REPARSE_DATA_BUFFER_SIZE bytes
-  class REPARSE_DATA_BUFFER < FFI::Struct
-    layout :ReparseTag, :win32_ulong,
-           :ReparseDataLength, :ushort,
-           :Reserved, :ushort,
-           :SubstituteNameOffset, :ushort,
-           :SubstituteNameLength, :ushort,
-           :PrintNameOffset, :ushort,
-           :PrintNameLength, :ushort,
-           :Flags, :win32_ulong,
-           # max less above fields dword / uint 4 bytes, ushort 2 bytes
-           # technically a WCHAR buffer, but we care about size in bytes here
-           :PathBuffer, [:byte, MAXIMUM_REPARSE_DATA_BUFFER_SIZE - 20]
-  end
-
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/ms724211(v=vs.85).aspx
-  # BOOL WINAPI CloseHandle(
-  #   _In_  HANDLE hObject
-  # );
-  ffi_lib 'kernel32'
-  attach_function_private :CloseHandle, [:handle], :win32_bool
-
   def symlink(target, symlink)
     flags = File.directory?(target) ? 0x1 : 0x0
     result = CreateSymbolicLinkW(wide_string(symlink.to_s),
       wide_string(target.to_s), flags)
     return true if result != FFI::WIN32_FALSE
     raise Puppet::Util::Windows::Error.new(
       "CreateSymbolicLink(#{symlink}, #{target}, #{flags.to_s(8)})")
   end
   module_function :symlink
 
   INVALID_FILE_ATTRIBUTES = 0xFFFFFFFF #define INVALID_FILE_ATTRIBUTES (DWORD (-1))
   def self.get_file_attributes(file_name)
     result = GetFileAttributesW(wide_string(file_name.to_s))
     return result unless result == INVALID_FILE_ATTRIBUTES
     raise Puppet::Util::Windows::Error.new("GetFileAttributes(#{file_name})")
   end
 
   INVALID_HANDLE_VALUE = -1 #define INVALID_HANDLE_VALUE ((HANDLE)(LONG_PTR)-1)
   def self.create_file(file_name, desired_access, share_mode, security_attributes,
     creation_disposition, flags_and_attributes, template_file_handle)
 
     result = CreateFileW(wide_string(file_name.to_s),
       desired_access, share_mode, security_attributes, creation_disposition,
       flags_and_attributes, template_file_handle)
 
     return result unless result == INVALID_HANDLE_VALUE
     raise Puppet::Util::Windows::Error.new(
       "CreateFile(#{file_name}, #{desired_access.to_s(8)}, #{share_mode.to_s(8)}, " +
         "#{security_attributes}, #{creation_disposition.to_s(8)}, " +
         "#{flags_and_attributes.to_s(8)}, #{template_file_handle})")
   end
 
   def self.device_io_control(handle, io_control_code, in_buffer = nil, out_buffer = nil)
     if out_buffer.nil?
       raise Puppet::Util::Windows::Error.new("out_buffer is required")
     end
 
     result = DeviceIoControl(
       handle,
       io_control_code,
       in_buffer, in_buffer.nil? ? 0 : in_buffer.size,
       out_buffer, out_buffer.size,
       FFI::MemoryPointer.new(:dword, 1),
       nil
     )
 
     return out_buffer if result != FFI::WIN32_FALSE
     raise Puppet::Util::Windows::Error.new(
       "DeviceIoControl(#{handle}, #{io_control_code}, " +
       "#{in_buffer}, #{in_buffer ? in_buffer.size : ''}, " +
       "#{out_buffer}, #{out_buffer ? out_buffer.size : ''}")
   end
 
   FILE_ATTRIBUTE_REPARSE_POINT = 0x400
   def symlink?(file_name)
     begin
       attributes = get_file_attributes(file_name)
       (attributes & FILE_ATTRIBUTE_REPARSE_POINT) == FILE_ATTRIBUTE_REPARSE_POINT
     rescue
       # raised INVALID_FILE_ATTRIBUTES is equivalent to file not found
       false
     end
   end
   module_function :symlink?
 
   GENERIC_READ                  = 0x80000000
   FILE_SHARE_READ               = 1
   OPEN_EXISTING                 = 3
   FILE_FLAG_OPEN_REPARSE_POINT  = 0x00200000
   FILE_FLAG_BACKUP_SEMANTICS    = 0x02000000
 
   def self.open_symlink(link_name)
     begin
       yield handle = create_file(
       wide_string(link_name.to_s),
       GENERIC_READ,
       FILE_SHARE_READ,
       nil, # security_attributes
       OPEN_EXISTING,
       FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS,
       0) # template_file
     ensure
       CloseHandle(handle) if handle
     end
   end
 
   def readlink(link_name)
     open_symlink(link_name) do |handle|
       resolve_symlink(handle)
     end
   end
   module_function :readlink
 
   def stat(file_name)
     file_name = file_name.to_s # accomodate PathName or String
     stat = File.stat(file_name)
     singleton_class = class << stat; self; end
     target_path = file_name
 
     if symlink?(file_name)
       target_path = readlink(file_name)
       link_ftype = File.stat(target_path).ftype
 
       # sigh, monkey patch instance method for instance, and close over link_ftype
       singleton_class.send(:define_method, :ftype) do
         link_ftype
       end
     end
 
     singleton_class.send(:define_method, :mode) do
       Puppet::Util::Windows::Security.get_mode(target_path)
     end
 
     stat
   end
   module_function :stat
 
   def lstat(file_name)
     file_name = file_name.to_s # accomodate PathName or String
     # monkey'ing around!
     stat = File.lstat(file_name)
 
     singleton_class = class << stat; self; end
     singleton_class.send(:define_method, :mode) do
       Puppet::Util::Windows::Security.get_mode(file_name)
     end
 
     if symlink?(file_name)
       def stat.ftype
         "link"
       end
     end
     stat
   end
   module_function :lstat
 
   private
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/aa364571(v=vs.85).aspx
   FSCTL_GET_REPARSE_POINT = 0x900a8
 
   def self.resolve_symlink(handle)
     # must be multiple of 1024, min 10240
     out_buffer = FFI::MemoryPointer.new(REPARSE_DATA_BUFFER.size)
     device_io_control(handle, FSCTL_GET_REPARSE_POINT, nil, out_buffer)
 
     reparse_data = REPARSE_DATA_BUFFER.new(out_buffer)
     offset = reparse_data[:PrintNameOffset]
     length = reparse_data[:PrintNameLength]
 
     result = reparse_data[:PathBuffer].to_a[offset, length].pack('C*')
     result.force_encoding('UTF-16LE').encode(Encoding.default_external)
   end
+
+  ffi_convention :stdcall
+
+  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa365512(v=vs.85).aspx
+  # BOOL WINAPI ReplaceFile(
+  #   _In_        LPCTSTR lpReplacedFileName,
+  #   _In_        LPCTSTR lpReplacementFileName,
+  #   _In_opt_    LPCTSTR lpBackupFileName,
+  #   _In_        DWORD dwReplaceFlags - 0x1 REPLACEFILE_WRITE_THROUGH,
+  #                                      0x2 REPLACEFILE_IGNORE_MERGE_ERRORS,
+  #                                      0x4 REPLACEFILE_IGNORE_ACL_ERRORS
+  #   _Reserved_  LPVOID lpExclude,
+  #   _Reserved_  LPVOID lpReserved
+  # );
+  ffi_lib :kernel32
+  attach_function_private :ReplaceFileW,
+    [:lpcwstr, :lpcwstr, :lpcwstr, :dword, :lpvoid, :lpvoid], :win32_bool
+
+  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa365240(v=vs.85).aspx
+  # BOOL WINAPI MoveFileEx(
+  #   _In_      LPCTSTR lpExistingFileName,
+  #   _In_opt_  LPCTSTR lpNewFileName,
+  #   _In_      DWORD dwFlags
+  # );
+  ffi_lib :kernel32
+  attach_function_private :MoveFileExW,
+    [:lpcwstr, :lpcwstr, :dword], :win32_bool
+
+  # BOOLEAN WINAPI CreateSymbolicLink(
+  #   _In_  LPTSTR lpSymlinkFileName, - symbolic link to be created
+  #   _In_  LPTSTR lpTargetFileName, - name of target for symbolic link
+  #   _In_  DWORD dwFlags - 0x0 target is a file, 0x1 target is a directory
+  # );
+  # rescue on Windows < 6.0 so that code doesn't explode
+  begin
+    ffi_lib :kernel32
+    attach_function_private :CreateSymbolicLinkW,
+      [:lpwstr, :lpwstr, :dword], :win32_bool
+  rescue LoadError
+  end
+
+  # DWORD WINAPI GetFileAttributes(
+  #   _In_  LPCTSTR lpFileName
+  # );
+  ffi_lib :kernel32
+  attach_function_private :GetFileAttributesW,
+    [:lpcwstr], :dword
+
+  # HANDLE WINAPI CreateFile(
+  #   _In_      LPCTSTR lpFileName,
+  #   _In_      DWORD dwDesiredAccess,
+  #   _In_      DWORD dwShareMode,
+  #   _In_opt_  LPSECURITY_ATTRIBUTES lpSecurityAttributes,
+  #   _In_      DWORD dwCreationDisposition,
+  #   _In_      DWORD dwFlagsAndAttributes,
+  #   _In_opt_  HANDLE hTemplateFile
+  # );
+  ffi_lib :kernel32
+  attach_function_private :CreateFileW,
+    [:lpcwstr, :dword, :dword, :pointer, :dword, :dword, :handle], :handle
+
+  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa363216(v=vs.85).aspx
+  # BOOL WINAPI DeviceIoControl(
+  #   _In_         HANDLE hDevice,
+  #   _In_         DWORD dwIoControlCode,
+  #   _In_opt_     LPVOID lpInBuffer,
+  #   _In_         DWORD nInBufferSize,
+  #   _Out_opt_    LPVOID lpOutBuffer,
+  #   _In_         DWORD nOutBufferSize,
+  #   _Out_opt_    LPDWORD lpBytesReturned,
+  #   _Inout_opt_  LPOVERLAPPED lpOverlapped
+  # );
+  ffi_lib :kernel32
+  attach_function_private :DeviceIoControl,
+    [:handle, :dword, :lpvoid, :dword, :lpvoid, :dword, :lpdword, :pointer], :win32_bool
+
+  MAXIMUM_REPARSE_DATA_BUFFER_SIZE = 16384
+
+  # REPARSE_DATA_BUFFER
+  # http://msdn.microsoft.com/en-us/library/cc232006.aspx
+  # http://msdn.microsoft.com/en-us/library/windows/hardware/ff552012(v=vs.85).aspx
+  # struct is always MAXIMUM_REPARSE_DATA_BUFFER_SIZE bytes
+  class REPARSE_DATA_BUFFER < FFI::Struct
+    layout :ReparseTag, :win32_ulong,
+           :ReparseDataLength, :ushort,
+           :Reserved, :ushort,
+           :SubstituteNameOffset, :ushort,
+           :SubstituteNameLength, :ushort,
+           :PrintNameOffset, :ushort,
+           :PrintNameLength, :ushort,
+           :Flags, :win32_ulong,
+           # max less above fields dword / uint 4 bytes, ushort 2 bytes
+           # technically a WCHAR buffer, but we care about size in bytes here
+           :PathBuffer, [:byte, MAXIMUM_REPARSE_DATA_BUFFER_SIZE - 20]
+  end
+
+  # http://msdn.microsoft.com/en-us/library/windows/desktop/ms724211(v=vs.85).aspx
+  # BOOL WINAPI CloseHandle(
+  #   _In_  HANDLE hObject
+  # );
+  ffi_lib :kernel32
+  attach_function_private :CloseHandle, [:handle], :win32_bool
 end
diff --git a/lib/puppet/util/windows/process.rb b/lib/puppet/util/windows/process.rb
index 1fdffba85..dfe5c81e5 100644
--- a/lib/puppet/util/windows/process.rb
+++ b/lib/puppet/util/windows/process.rb
@@ -1,312 +1,312 @@
 require 'puppet/util/windows'
 require 'win32/process'
 require 'ffi'
 
 module Puppet::Util::Windows::Process
   extend Puppet::Util::Windows::String
   extend FFI::Library
 
   WAIT_TIMEOUT = 0x102
 
   def execute(command, arguments, stdin, stdout, stderr)
     Process.create( :command_line => command, :startup_info => {:stdin => stdin, :stdout => stdout, :stderr => stderr}, :close_handles => false )
   end
   module_function :execute
 
   def wait_process(handle)
     while WaitForSingleObject(handle, 0) == WAIT_TIMEOUT
       sleep(1)
     end
 
     exit_status = FFI::MemoryPointer.new(:dword, 1)
     if GetExitCodeProcess(handle, exit_status) == FFI::WIN32_FALSE
       raise Puppet::Util::Windows::Error.new("Failed to get child process exit code")
     end
     exit_status = exit_status.read_dword
 
     # $CHILD_STATUS is not set when calling win32/process Process.create
     # and since it's read-only, we can't set it. But we can execute a
     # a shell that simply returns the desired exit status, which has the
     # desired effect.
     %x{#{ENV['COMSPEC']} /c exit #{exit_status}}
 
     exit_status
   end
   module_function :wait_process
 
   def get_current_process
     # this pseudo-handle does not require closing per MSDN docs
     GetCurrentProcess()
   end
   module_function :get_current_process
 
   def open_process_token(handle, desired_access)
     token_handle_ptr = FFI::MemoryPointer.new(:handle, 1)
     result = OpenProcessToken(handle, desired_access, token_handle_ptr)
     if result == FFI::WIN32_FALSE
       raise Puppet::Util::Windows::Error.new(
         "OpenProcessToken(#{handle}, #{desired_access.to_s(8)}, #{token_handle_ptr})")
     end
 
     begin
       yield token_handle = token_handle_ptr.read_handle
     ensure
       CloseHandle(token_handle)
     end
   end
   module_function :open_process_token
 
   def lookup_privilege_value(name, system_name = '')
     luid = FFI::MemoryPointer.new(LUID.size)
     result = LookupPrivilegeValueW(
       wide_string(system_name),
       wide_string(name.to_s),
       luid
       )
 
     return LUID.new(luid) if result != FFI::WIN32_FALSE
     raise Puppet::Util::Windows::Error.new(
       "LookupPrivilegeValue(#{system_name}, #{name}, #{luid})")
   end
   module_function :lookup_privilege_value
 
   def get_token_information(token_handle, token_information)
     # to determine buffer size
     return_length_ptr = FFI::MemoryPointer.new(:dword, 1)
     result = GetTokenInformation(token_handle, token_information, nil, 0, return_length_ptr)
     return_length = return_length_ptr.read_dword
 
     if return_length <= 0
       raise Puppet::Util::Windows::Error.new(
         "GetTokenInformation(#{token_handle}, #{token_information}, nil, 0, #{return_length_ptr})")
     end
 
     # re-call API with properly sized buffer for all results
     token_information_buf = FFI::MemoryPointer.new(return_length)
     result = GetTokenInformation(token_handle, token_information,
       token_information_buf, return_length, return_length_ptr)
 
     if result == FFI::WIN32_FALSE
       raise Puppet::Util::Windows::Error.new(
         "GetTokenInformation(#{token_handle}, #{token_information}, #{token_information_buf}, " +
           "#{return_length}, #{return_length_ptr})")
     end
 
     token_information_buf
   end
   module_function :get_token_information
 
   def parse_token_information_as_token_privileges(token_information_buf)
     raw_privileges = TOKEN_PRIVILEGES.new(token_information_buf)
     privileges = { :count => raw_privileges[:PrivilegeCount], :privileges => [] }
 
     offset = token_information_buf + TOKEN_PRIVILEGES.offset_of(:Privileges)
     privilege_ptr = FFI::Pointer.new(LUID_AND_ATTRIBUTES, offset)
 
     # extract each instance of LUID_AND_ATTRIBUTES
     0.upto(privileges[:count] - 1) do |i|
       privileges[:privileges] <<  LUID_AND_ATTRIBUTES.new(privilege_ptr[i])
     end
 
     privileges
   end
   module_function :parse_token_information_as_token_privileges
 
   def parse_token_information_as_token_elevation(token_information_buf)
     TOKEN_ELEVATION.new(token_information_buf)
   end
   module_function :parse_token_information_as_token_elevation
 
   TOKEN_ALL_ACCESS = 0xF01FF
   ERROR_NO_SUCH_PRIVILEGE = 1313
   def process_privilege_symlink?
     handle = get_current_process
     open_process_token(handle, TOKEN_ALL_ACCESS) do |token_handle|
       luid = lookup_privilege_value('SeCreateSymbolicLinkPrivilege')
       token_info = get_token_information(token_handle, :TokenPrivileges)
       token_privileges = parse_token_information_as_token_privileges(token_info)
       token_privileges[:privileges].any? { |p| p[:Luid].values == luid.values }
     end
   rescue Puppet::Util::Windows::Error => e
     if e.code == ERROR_NO_SUCH_PRIVILEGE
       false # pre-Vista
     else
       raise e
     end
   end
   module_function :process_privilege_symlink?
 
   TOKEN_QUERY = 0x0008
   # Returns whether or not the owner of the current process is running
   # with elevated security privileges.
   #
   # Only supported on Windows Vista or later.
   #
   def elevated_security?
     handle = get_current_process
     open_process_token(handle, TOKEN_QUERY) do |token_handle|
       token_info = get_token_information(token_handle, :TokenElevation)
       token_elevation = parse_token_information_as_token_elevation(token_info)
       # TokenIsElevated member of the TOKEN_ELEVATION struct
       token_elevation[:TokenIsElevated] != 0
     end
   rescue Puppet::Util::Windows::Error => e
     if e.code == ERROR_NO_SUCH_PRIVILEGE
       false # pre-Vista
     else
       raise e
     end
   ensure
     CloseHandle(handle)
   end
   module_function :elevated_security?
 
 
   ffi_convention :stdcall
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/ms687032(v=vs.85).aspx
   # DWORD WINAPI WaitForSingleObject(
   #   _In_  HANDLE hHandle,
   #   _In_  DWORD dwMilliseconds
   # );
-  ffi_lib 'kernel32'
+  ffi_lib :kernel32
   attach_function_private :WaitForSingleObject,
     [:handle, :dword], :dword
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/ms683189(v=vs.85).aspx
   # BOOL WINAPI GetExitCodeProcess(
   #   _In_   HANDLE hProcess,
   #   _Out_  LPDWORD lpExitCode
   # );
-  ffi_lib 'kernel32'
+  ffi_lib :kernel32
   attach_function_private :GetExitCodeProcess,
     [:handle, :lpdword], :win32_bool
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/ms683179(v=vs.85).aspx
   # HANDLE WINAPI GetCurrentProcess(void);
-  ffi_lib 'kernel32'
+  ffi_lib :kernel32
   attach_function_private :GetCurrentProcess, [], :handle
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/ms724211(v=vs.85).aspx
   # BOOL WINAPI CloseHandle(
   #   _In_  HANDLE hObject
   # );
-  ffi_lib 'kernel32'
+  ffi_lib :kernel32
   attach_function_private :CloseHandle, [:handle], :win32_bool
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379295(v=vs.85).aspx
   # BOOL WINAPI OpenProcessToken(
   #   _In_   HANDLE ProcessHandle,
   #   _In_   DWORD DesiredAccess,
   #   _Out_  PHANDLE TokenHandle
   # );
-  ffi_lib 'advapi32'
+  ffi_lib :advapi32
   attach_function_private :OpenProcessToken,
     [:handle, :dword, :phandle], :win32_bool
 
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379261(v=vs.85).aspx
   # typedef struct _LUID {
   #   DWORD LowPart;
   #   LONG  HighPart;
   # } LUID, *PLUID;
   class LUID < FFI::Struct
     layout :LowPart, :dword,
            :HighPart, :win32_long
   end
 
   # http://msdn.microsoft.com/en-us/library/Windows/desktop/aa379180(v=vs.85).aspx
   # BOOL WINAPI LookupPrivilegeValue(
   #   _In_opt_  LPCTSTR lpSystemName,
   #   _In_      LPCTSTR lpName,
   #   _Out_     PLUID lpLuid
   # );
-  ffi_lib 'advapi32'
+  ffi_lib :advapi32
   attach_function_private :LookupPrivilegeValueW,
     [:lpcwstr, :lpcwstr, :pointer], :win32_bool
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379626(v=vs.85).aspx
   TOKEN_INFORMATION_CLASS = enum(
       :TokenUser, 1,
       :TokenGroups,
       :TokenPrivileges,
       :TokenOwner,
       :TokenPrimaryGroup,
       :TokenDefaultDacl,
       :TokenSource,
       :TokenType,
       :TokenImpersonationLevel,
       :TokenStatistics,
       :TokenRestrictedSids,
       :TokenSessionId,
       :TokenGroupsAndPrivileges,
       :TokenSessionReference,
       :TokenSandBoxInert,
       :TokenAuditPolicy,
       :TokenOrigin,
       :TokenElevationType,
       :TokenLinkedToken,
       :TokenElevation,
       :TokenHasRestrictions,
       :TokenAccessInformation,
       :TokenVirtualizationAllowed,
       :TokenVirtualizationEnabled,
       :TokenIntegrityLevel,
       :TokenUIAccess,
       :TokenMandatoryPolicy,
       :TokenLogonSid,
       :TokenIsAppContainer,
       :TokenCapabilities,
       :TokenAppContainerSid,
       :TokenAppContainerNumber,
       :TokenUserClaimAttributes,
       :TokenDeviceClaimAttributes,
       :TokenRestrictedUserClaimAttributes,
       :TokenRestrictedDeviceClaimAttributes,
       :TokenDeviceGroups,
       :TokenRestrictedDeviceGroups,
       :TokenSecurityAttributes,
       :TokenIsRestricted,
       :MaxTokenInfoClass
   )
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379263(v=vs.85).aspx
   # typedef struct _LUID_AND_ATTRIBUTES {
   #   LUID  Luid;
   #   DWORD Attributes;
   # } LUID_AND_ATTRIBUTES, *PLUID_AND_ATTRIBUTES;
   class LUID_AND_ATTRIBUTES < FFI::Struct
     layout :Luid, LUID,
            :Attributes, :dword
   end
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379630(v=vs.85).aspx
   # typedef struct _TOKEN_PRIVILEGES {
   #   DWORD               PrivilegeCount;
   #   LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
   # } TOKEN_PRIVILEGES, *PTOKEN_PRIVILEGES;
   class TOKEN_PRIVILEGES < FFI::Struct
     layout :PrivilegeCount, :dword,
            :Privileges, [LUID_AND_ATTRIBUTES, 1]    # placeholder for offset
   end
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/bb530717(v=vs.85).aspx
   # typedef struct _TOKEN_ELEVATION {
   #   DWORD TokenIsElevated;
   # } TOKEN_ELEVATION, *PTOKEN_ELEVATION;
   class TOKEN_ELEVATION < FFI::Struct
     layout :TokenIsElevated, :dword
   end
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/aa446671(v=vs.85).aspx
   # BOOL WINAPI GetTokenInformation(
   #   _In_       HANDLE TokenHandle,
   #   _In_       TOKEN_INFORMATION_CLASS TokenInformationClass,
   #   _Out_opt_  LPVOID TokenInformation,
   #   _In_       DWORD TokenInformationLength,
   #   _Out_      PDWORD ReturnLength
   # );
-  ffi_lib 'advapi32'
+  ffi_lib :advapi32
   attach_function_private :GetTokenInformation,
     [:handle, TOKEN_INFORMATION_CLASS, :lpvoid, :dword, :pdword ], :win32_bool
 end
diff --git a/lib/puppet/util/windows/user.rb b/lib/puppet/util/windows/user.rb
index 259fbc9c3..611584e67 100644
--- a/lib/puppet/util/windows/user.rb
+++ b/lib/puppet/util/windows/user.rb
@@ -1,288 +1,288 @@
 require 'puppet/util/windows'
 
 require 'facter'
 require 'ffi'
 
 module Puppet::Util::Windows::User
   extend Puppet::Util::Windows::String
   extend FFI::Library
 
   def admin?
     majversion = Facter.value(:kernelmajversion)
     return false unless majversion
 
     # if Vista or later, check for unrestricted process token
     return Puppet::Util::Windows::Process.elevated_security? unless majversion.to_f < 6.0
 
     # otherwise 2003 or less
     check_token_membership
   end
   module_function :admin?
 
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/ee207397(v=vs.85).aspx
   SECURITY_MAX_SID_SIZE = 68
 
   def check_token_membership
     sid_pointer = FFI::MemoryPointer.new(:byte, SECURITY_MAX_SID_SIZE)
     size_pointer = FFI::MemoryPointer.new(:dword, 1)
     size_pointer.write_uint32(SECURITY_MAX_SID_SIZE)
 
     if CreateWellKnownSid(:WinBuiltinAdministratorsSid, FFI::Pointer::NULL, sid_pointer, size_pointer) == FFI::WIN32_FALSE
       raise Puppet::Util::Windows::Error.new("Failed to create administrators SID")
     end
 
     if IsValidSid(sid_pointer) == FFI::WIN32_FALSE
       raise Puppet::Util::Windows::Error.new("Invalid SID")
     end
 
     ismember_pointer = FFI::MemoryPointer.new(:win32_bool, 1)
     if CheckTokenMembership(FFI::Pointer::NULL_HANDLE, sid_pointer, ismember_pointer) == FFI::WIN32_FALSE
       raise Puppet::Util::Windows::Error.new("Failed to check membership")
     end
 
     # Is administrators SID enabled in calling thread's access token?
     ismember_pointer.read_win32_bool
   end
   module_function :check_token_membership
 
   def password_is?(name, password)
     logon_user(name, password)
     true
   rescue Puppet::Util::Windows::Error
     false
   end
   module_function :password_is?
 
   def logon_user(name, password, &block)
     fLOGON32_LOGON_NETWORK = 3
     fLOGON32_PROVIDER_DEFAULT = 0
 
     token_pointer = FFI::MemoryPointer.new(:handle, 1)
     if LogonUserW(wide_string(name), wide_string('.'), wide_string(password),
         fLOGON32_LOGON_NETWORK, fLOGON32_PROVIDER_DEFAULT, token_pointer) == FFI::WIN32_FALSE
       raise Puppet::Util::Windows::Error.new("Failed to logon user #{name.inspect}")
     end
 
     token = token_pointer.read_handle
     begin
       yield token if block_given?
     ensure
       CloseHandle(token)
     end
   end
   module_function :logon_user
 
   def load_profile(user, password)
     logon_user(user, password) do |token|
       pi = PROFILEINFO.new
       pi[:dwSize] = PROFILEINFO.size
       pi[:dwFlags] = 1 # PI_NOUI - prevents display of profile error msgs
       pi[:lpUserName] = FFI::MemoryPointer.from_string_to_wide_string(user)
 
       # Load the profile. Since it doesn't exist, it will be created
       if LoadUserProfileW(token, pi.pointer) == FFI::WIN32_FALSE
         raise Puppet::Util::Windows::Error.new("Failed to load user profile #{user.inspect}")
       end
 
       Puppet.debug("Loaded profile for #{user}")
 
       if UnloadUserProfile(token, pi[:hProfile]) == FFI::WIN32_FALSE
         raise Puppet::Util::Windows::Error.new("Failed to unload user profile #{user.inspect}")
       end
     end
   end
   module_function :load_profile
 
   ffi_convention :stdcall
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx
   # BOOL LogonUser(
   #   _In_      LPTSTR lpszUsername,
   #   _In_opt_  LPTSTR lpszDomain,
   #   _In_opt_  LPTSTR lpszPassword,
   #   _In_      DWORD dwLogonType,
   #   _In_      DWORD dwLogonProvider,
   #   _Out_     PHANDLE phToken
   # );
   ffi_lib :advapi32
   attach_function_private :LogonUserW,
     [:lpwstr, :lpwstr, :lpwstr, :dword, :dword, :phandle], :win32_bool
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/ms724211(v=vs.85).aspx
   # BOOL WINAPI CloseHandle(
   #   _In_  HANDLE hObject
   # );
-  ffi_lib 'kernel32'
+  ffi_lib :kernel32
   attach_function_private :CloseHandle, [:handle], :win32_bool
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/bb773378(v=vs.85).aspx
   # typedef struct _PROFILEINFO {
   #   DWORD  dwSize;
   #   DWORD  dwFlags;
   #   LPTSTR lpUserName;
   #   LPTSTR lpProfilePath;
   #   LPTSTR lpDefaultPath;
   #   LPTSTR lpServerName;
   #   LPTSTR lpPolicyPath;
   #   HANDLE hProfile;
   # } PROFILEINFO, *LPPROFILEINFO;
   # technically
   # NOTE: that for structs, buffer_* (lptstr alias) cannot be used
   class PROFILEINFO < FFI::Struct
     layout :dwSize, :dword,
            :dwFlags, :dword,
            :lpUserName, :pointer,
            :lpProfilePath, :pointer,
            :lpDefaultPath, :pointer,
            :lpServerName, :pointer,
            :lpPolicyPath, :pointer,
            :hProfile, :handle
   end
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/bb762281(v=vs.85).aspx
   # BOOL WINAPI LoadUserProfile(
   #   _In_     HANDLE hToken,
   #   _Inout_  LPPROFILEINFO lpProfileInfo
   # );
   ffi_lib :userenv
   attach_function_private :LoadUserProfileW,
     [:handle, :pointer], :win32_bool
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/bb762282(v=vs.85).aspx
   # BOOL WINAPI UnloadUserProfile(
   #   _In_  HANDLE hToken,
   #   _In_  HANDLE hProfile
   # );
   ffi_lib :userenv
   attach_function_private :UnloadUserProfile,
     [:handle, :handle], :win32_bool
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/aa376389(v=vs.85).aspx
   # BOOL WINAPI CheckTokenMembership(
   #   _In_opt_  HANDLE TokenHandle,
   #   _In_      PSID SidToCheck,
   #   _Out_     PBOOL IsMember
   # );
   ffi_lib :advapi32
   attach_function_private :CheckTokenMembership,
     [:handle, :pointer, :pbool], :win32_bool
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379650(v=vs.85).aspx
   WELL_KNOWN_SID_TYPE = enum(
     :WinNullSid                                   , 0,
     :WinWorldSid                                  , 1,
     :WinLocalSid                                  , 2,
     :WinCreatorOwnerSid                           , 3,
     :WinCreatorGroupSid                           , 4,
     :WinCreatorOwnerServerSid                     , 5,
     :WinCreatorGroupServerSid                     , 6,
     :WinNtAuthoritySid                            , 7,
     :WinDialupSid                                 , 8,
     :WinNetworkSid                                , 9,
     :WinBatchSid                                  , 10,
     :WinInteractiveSid                            , 11,
     :WinServiceSid                                , 12,
     :WinAnonymousSid                              , 13,
     :WinProxySid                                  , 14,
     :WinEnterpriseControllersSid                  , 15,
     :WinSelfSid                                   , 16,
     :WinAuthenticatedUserSid                      , 17,
     :WinRestrictedCodeSid                         , 18,
     :WinTerminalServerSid                         , 19,
     :WinRemoteLogonIdSid                          , 20,
     :WinLogonIdsSid                               , 21,
     :WinLocalSystemSid                            , 22,
     :WinLocalServiceSid                           , 23,
     :WinNetworkServiceSid                         , 24,
     :WinBuiltinDomainSid                          , 25,
     :WinBuiltinAdministratorsSid                  , 26,
     :WinBuiltinUsersSid                           , 27,
     :WinBuiltinGuestsSid                          , 28,
     :WinBuiltinPowerUsersSid                      , 29,
     :WinBuiltinAccountOperatorsSid                , 30,
     :WinBuiltinSystemOperatorsSid                 , 31,
     :WinBuiltinPrintOperatorsSid                  , 32,
     :WinBuiltinBackupOperatorsSid                 , 33,
     :WinBuiltinReplicatorSid                      , 34,
     :WinBuiltinPreWindows2000CompatibleAccessSid  , 35,
     :WinBuiltinRemoteDesktopUsersSid              , 36,
     :WinBuiltinNetworkConfigurationOperatorsSid   , 37,
     :WinAccountAdministratorSid                   , 38,
     :WinAccountGuestSid                           , 39,
     :WinAccountKrbtgtSid                          , 40,
     :WinAccountDomainAdminsSid                    , 41,
     :WinAccountDomainUsersSid                     , 42,
     :WinAccountDomainGuestsSid                    , 43,
     :WinAccountComputersSid                       , 44,
     :WinAccountControllersSid                     , 45,
     :WinAccountCertAdminsSid                      , 46,
     :WinAccountSchemaAdminsSid                    , 47,
     :WinAccountEnterpriseAdminsSid                , 48,
     :WinAccountPolicyAdminsSid                    , 49,
     :WinAccountRasAndIasServersSid                , 50,
     :WinNTLMAuthenticationSid                     , 51,
     :WinDigestAuthenticationSid                   , 52,
     :WinSChannelAuthenticationSid                 , 53,
     :WinThisOrganizationSid                       , 54,
     :WinOtherOrganizationSid                      , 55,
     :WinBuiltinIncomingForestTrustBuildersSid     , 56,
     :WinBuiltinPerfMonitoringUsersSid             , 57,
     :WinBuiltinPerfLoggingUsersSid                , 58,
     :WinBuiltinAuthorizationAccessSid             , 59,
     :WinBuiltinTerminalServerLicenseServersSid    , 60,
     :WinBuiltinDCOMUsersSid                       , 61,
     :WinBuiltinIUsersSid                          , 62,
     :WinIUserSid                                  , 63,
     :WinBuiltinCryptoOperatorsSid                 , 64,
     :WinUntrustedLabelSid                         , 65,
     :WinLowLabelSid                               , 66,
     :WinMediumLabelSid                            , 67,
     :WinHighLabelSid                              , 68,
     :WinSystemLabelSid                            , 69,
     :WinWriteRestrictedCodeSid                    , 70,
     :WinCreatorOwnerRightsSid                     , 71,
     :WinCacheablePrincipalsGroupSid               , 72,
     :WinNonCacheablePrincipalsGroupSid            , 73,
     :WinEnterpriseReadonlyControllersSid          , 74,
     :WinAccountReadonlyControllersSid             , 75,
     :WinBuiltinEventLogReadersGroup               , 76,
     :WinNewEnterpriseReadonlyControllersSid       , 77,
     :WinBuiltinCertSvcDComAccessGroup             , 78,
     :WinMediumPlusLabelSid                        , 79,
     :WinLocalLogonSid                             , 80,
     :WinConsoleLogonSid                           , 81,
     :WinThisOrganizationCertificateSid            , 82,
     :WinApplicationPackageAuthoritySid            , 83,
     :WinBuiltinAnyPackageSid                      , 84,
     :WinCapabilityInternetClientSid               , 85,
     :WinCapabilityInternetClientServerSid         , 86,
     :WinCapabilityPrivateNetworkClientServerSid   , 87,
     :WinCapabilityPicturesLibrarySid              , 88,
     :WinCapabilityVideosLibrarySid                , 89,
     :WinCapabilityMusicLibrarySid                 , 90,
     :WinCapabilityDocumentsLibrarySid             , 91,
     :WinCapabilitySharedUserCertificatesSid       , 92,
     :WinCapabilityEnterpriseAuthenticationSid     , 93,
     :WinCapabilityRemovableStorageSid             , 94
   )
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/aa446585(v=vs.85).aspx
   # BOOL WINAPI CreateWellKnownSid(
   #   _In_       WELL_KNOWN_SID_TYPE WellKnownSidType,
   #   _In_opt_   PSID DomainSid,
   #   _Out_opt_  PSID pSid,
   #   _Inout_    DWORD *cbSid
   # );
   ffi_lib :advapi32
   attach_function_private :CreateWellKnownSid,
     [WELL_KNOWN_SID_TYPE, :pointer, :pointer, :lpdword], :win32_bool
 
   # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379151(v=vs.85).aspx
   # BOOL WINAPI IsValidSid(
   #   _In_  PSID pSid
   # );
   ffi_lib :advapi32
   attach_function_private :IsValidSid,
     [:pointer], :win32_bool
 end