diff --git a/lib/puppet/util/suidmanager.rb b/lib/puppet/util/suidmanager.rb
index ccaa6eca5..d93915567 100644
--- a/lib/puppet/util/suidmanager.rb
+++ b/lib/puppet/util/suidmanager.rb
@@ -1,166 +1,155 @@
 require 'puppet/util/warnings'
 require 'forwardable'
 require 'etc'
 
 module Puppet::Util::SUIDManager
   include Puppet::Util::Warnings
   extend Forwardable
 
   # Note groups= is handled specially due to a bug in OS X 10.6
   to_delegate_to_process = [ :euid=, :euid, :egid=, :egid, :uid=, :uid, :gid=, :gid, :groups ]
 
   to_delegate_to_process.each do |method|
     def_delegator Process, method
     module_function method
   end
 
   def osx_maj_ver
     return @osx_maj_ver unless @osx_maj_ver.nil?
     require 'facter'
     # 'kernel' is available without explicitly loading all facts
     if Facter.value('kernel') != 'Darwin'
       @osx_maj_ver = false
       return @osx_maj_ver
     end
     # But 'macosx_productversion_major' requires it.
     Facter.loadfacts
     @osx_maj_ver = Facter.value('macosx_productversion_major')
   end
   module_function :osx_maj_ver
 
   def groups=(grouplist)
     if osx_maj_ver == '10.6'
       return true
     else
       return Process.groups = grouplist
     end
   end
   module_function :groups=
 
   def self.root?
     Process.uid == 0
   end
 
   # Methods to handle changing uid/gid of the running process. In general,
   # these will noop or fail on Windows, and require root to change to anything
   # but the current uid/gid (which is a noop).
 
   # Runs block setting euid and egid if provided then restoring original ids.
   # If running on Windows or without root, the block will be run with the
   # current euid/egid.
   def asuser(new_uid=nil, new_gid=nil)
     return yield if Puppet.features.microsoft_windows?
     return yield unless root?
     return yield unless new_uid or new_gid
 
     old_euid, old_egid = self.euid, self.egid
     begin
       change_privileges(new_uid, new_gid, false)
 
       yield
     ensure
       change_privileges(new_uid ? old_euid : nil, old_egid, false)
     end
   end
   module_function :asuser
 
   # If `permanently` is set, will permanently change the uid/gid of the
   # process. If not, it will only set the euid/egid. If only uid is supplied,
   # the primary group of the supplied gid will be used. If only gid is
   # supplied, only gid will be changed. This method will fail if used on
   # Windows.
   def change_privileges(uid=nil, gid=nil, permanently=false)
     return unless uid or gid
 
     unless gid
       uid = convert_xid(:uid, uid)
       gid = Etc.getpwuid(uid).gid
     end
 
     change_group(gid, permanently)
     change_user(uid, permanently) if uid
   end
   module_function :change_privileges
 
   # Changes the egid of the process if `permanently` is not set, otherwise
   # changes gid. This method will fail if used on Windows, or attempting to
   # change to a different gid without root.
   def change_group(group, permanently=false)
     gid = convert_xid(:gid, group)
     raise Puppet::Error, "No such group #{group}" unless gid
 
     if permanently
-      begin
-        Process::GID.change_privilege(gid)
-      rescue NotImplementedError
-        Process.egid = gid
-        Process.gid  = gid
-      end
+      Process::GID.change_privilege(gid)
     else
       Process.egid = gid
     end
   end
   module_function :change_group
 
   # As change_group, but operates on uids. If changing user permanently,
   # supplementary groups will be set the to default groups for the new uid.
   def change_user(user, permanently=false)
     uid = convert_xid(:uid, user)
     raise Puppet::Error, "No such user #{user}" unless uid
 
     if permanently
       # If changing uid, we must be root. So initgroups first here.
       initgroups(uid)
 
-      begin
-        # Prefer the better `change_privilege` method, but if that fails us,
-        # fall back to directly setting the values.
-        Process::UID.change_privilege(uid)
-      rescue NotImplementedError
-        Process.euid = uid
-        Process.uid  = uid
-      end
+      Process::UID.change_privilege(uid)
     else
-      # If we're already root, initgroups before changing euid. If we're not,
+      # We must be root to initgroups, so initgroups before dropping euid if
+      # we're root, otherwise elevate euid before initgroups.
       # change euid (to root) first.
       if Process.euid == 0
         initgroups(uid)
         Process.euid = uid
       else
         Process.euid = uid
         initgroups(uid)
       end
     end
   end
   module_function :change_user
 
   # Make sure the passed argument is a number.
   def convert_xid(type, id)
     map = {:gid => :group, :uid => :user}
     raise ArgumentError, "Invalid id type #{type}" unless map.include?(type)
     ret = Puppet::Util.send(type, id)
     if ret == nil
       raise Puppet::Error, "Invalid #{map[type]}: #{id}"
     end
     ret
   end
   module_function :convert_xid
 
   # Initialize primary and supplemental groups to those of the target user.  We
   # take the UID and manually look up their details in the system database,
   # including username and primary group. This method will fail on Windows, or
   # if used without root to initgroups of another user.
   def initgroups(uid)
     pwent = Etc.getpwuid(uid)
     Process.initgroups(pwent.name, pwent.gid)
   end
 
   module_function :initgroups
 
   def run_and_capture(command, new_uid=nil, new_gid=nil)
     output = Puppet::Util.execute(command, :failonfail => false, :combine => true, :uid => new_uid, :gid => new_gid)
     [output, $CHILD_STATUS.dup]
   end
   module_function :run_and_capture
 end
 
diff --git a/spec/unit/util/suidmanager_spec.rb b/spec/unit/util/suidmanager_spec.rb
index 6ca69abd6..62ee9bc0a 100755
--- a/spec/unit/util/suidmanager_spec.rb
+++ b/spec/unit/util/suidmanager_spec.rb
@@ -1,240 +1,220 @@
 #!/usr/bin/env rspec
 
 require 'spec_helper'
 
 describe Puppet::Util::SUIDManager do
   let :user do
     Puppet::Type.type(:user).new(:name => 'name', :uid => 42, :gid => 42)
   end
 
   let :xids do
     Hash.new {|h,k| 0}
   end
 
   before :each do
     Puppet::Util::SUIDManager.stubs(:convert_xid).returns(42)
     pwent = stub('pwent', :name => 'fred', :uid => 42, :gid => 42)
     Etc.stubs(:getpwuid).with(42).returns(pwent)
 
     [:euid, :egid, :uid, :gid, :groups].each do |id|
       Process.stubs("#{id}=").with {|value| xids[id] = value }
     end
   end
 
   describe "#initgroups" do
     it "should use the primary group of the user as the 'basegid'" do
       Process.expects(:initgroups).with('fred', 42)
       described_class.initgroups(42)
     end
   end
 
   describe "#uid" do
     it "should allow setting euid/egid" do
       Puppet::Util::SUIDManager.egid = user[:gid]
       Puppet::Util::SUIDManager.euid = user[:uid]
 
       xids[:egid].should == user[:gid]
       xids[:euid].should == user[:uid]
     end
   end
 
   describe "#asuser" do
     it "should not get or set euid/egid when not root" do
       Process.stubs(:uid).returns(1)
 
       Process.stubs(:egid).returns(51)
       Process.stubs(:euid).returns(50)
 
       Puppet::Util::SUIDManager.asuser(user[:uid], user[:gid]) {}
 
       xids.should be_empty
     end
 
     context "when root and not windows" do
       before :each do
         Process.stubs(:uid).returns(0)
         Puppet.features.stubs(:microsoft_windows?).returns(false)
       end
 
       it "should set euid/egid when root" do
         Process.stubs(:uid).returns(0)
 
         Process.stubs(:egid).returns(51)
         Process.stubs(:euid).returns(50)
 
         Puppet::Util::SUIDManager.stubs(:convert_xid).with(:gid, 51).returns(51)
         Puppet::Util::SUIDManager.stubs(:convert_xid).with(:uid, 50).returns(50)
         Puppet::Util::SUIDManager.stubs(:initgroups).returns([])
 
         yielded = false
         Puppet::Util::SUIDManager.asuser(user[:uid], user[:gid]) do
           xids[:egid].should == user[:gid]
           xids[:euid].should == user[:uid]
           yielded = true
         end
 
         xids[:egid].should == 51
         xids[:euid].should == 50
 
         # It's possible asuser could simply not yield, so the assertions in the
         # block wouldn't fail. So verify those actually got checked.
         yielded.should be_true
       end
 
       it "should just yield if user and group are nil" do
         yielded = false
         Puppet::Util::SUIDManager.asuser(nil, nil) { yielded = true }
         yielded.should be_true
         xids.should == {}
       end
 
       it "should just change group if only group is given" do
         yielded = false
         Puppet::Util::SUIDManager.asuser(nil, 42) { yielded = true }
         yielded.should be_true
         xids.should == { :egid => 42 }
       end
 
       it "should change gid to the primary group of uid by default" do
         Process.stubs(:initgroups)
 
         yielded = false
         Puppet::Util::SUIDManager.asuser(42) { yielded = true }
         yielded.should be_true
         xids.should == { :euid => 42, :egid => 42 }
       end
 
       it "should change both uid and gid if given" do
         # I don't like the sequence, but it is the only way to assert on the
         # internal behaviour in a reliable fashion, given we need multiple
         # sequenced calls to the same methods. --daniel 2012-02-05
         horror = sequence('of user and group changes')
         Puppet::Util::SUIDManager.expects(:change_group).with(43, false).in_sequence(horror)
         Puppet::Util::SUIDManager.expects(:change_user).with(42, false).in_sequence(horror)
         Puppet::Util::SUIDManager.expects(:change_group).
           with(Puppet::Util::SUIDManager.egid, false).in_sequence(horror)
         Puppet::Util::SUIDManager.expects(:change_user).
           with(Puppet::Util::SUIDManager.euid, false).in_sequence(horror)
 
         yielded = false
         Puppet::Util::SUIDManager.asuser(42, 43) { yielded = true }
         yielded.should be_true
       end
     end
   end
 
   describe "#change_group" do
     describe "when changing permanently" do
-      it "should try to change_privilege if it is supported" do
+      it "should change_privilege" do
         Process::GID.expects(:change_privilege).with do |gid|
           Process.gid = gid
           Process.egid = gid
         end
 
         Puppet::Util::SUIDManager.change_group(42, true)
 
         xids[:egid].should == 42
         xids[:gid].should == 42
       end
-
-      it "should change both egid and gid if change_privilege isn't supported" do
-        Process::GID.stubs(:change_privilege).raises(NotImplementedError)
-
-        Puppet::Util::SUIDManager.change_group(42, true)
-
-        xids[:egid].should == 42
-        xids[:gid].should == 42
-      end
     end
 
     describe "when changing temporarily" do
       it "should change only egid" do
         Puppet::Util::SUIDManager.change_group(42, false)
 
         xids[:egid].should == 42
         xids[:gid].should == 0
       end
     end
   end
 
   describe "#change_user" do
     describe "when changing permanently" do
-      it "should try to change_privilege if it is supported" do
+      it "should change_privilege" do
         Process::UID.expects(:change_privilege).with do |uid|
           Process.uid = uid
           Process.euid = uid
         end
 
         Puppet::Util::SUIDManager.expects(:initgroups).with(42)
 
         Puppet::Util::SUIDManager.change_user(42, true)
 
         xids[:euid].should == 42
         xids[:uid].should == 42
       end
-
-      it "should change euid and uid and groups if change_privilege isn't supported" do
-        Process::UID.stubs(:change_privilege).raises(NotImplementedError)
-
-        Puppet::Util::SUIDManager.expects(:initgroups).with(42)
-
-        Puppet::Util::SUIDManager.change_user(42, true)
-
-        xids[:euid].should == 42
-        xids[:uid].should == 42
-      end
     end
 
     describe "when changing temporarily" do
       it "should change only euid and groups" do
         Puppet::Util::SUIDManager.stubs(:initgroups).returns([])
         Puppet::Util::SUIDManager.change_user(42, false)
 
         xids[:euid].should == 42
         xids[:uid].should == 0
       end
 
       it "should set euid before groups if changing to root" do
         Process.stubs(:euid).returns 50
 
         when_not_root = sequence 'when_not_root'
 
         Process.expects(:euid=).in_sequence(when_not_root)
         Puppet::Util::SUIDManager.expects(:initgroups).in_sequence(when_not_root)
 
         Puppet::Util::SUIDManager.change_user(0, false)
       end
 
       it "should set groups before euid if changing from root" do
         Process.stubs(:euid).returns 0
 
         when_root = sequence 'when_root'
 
         Puppet::Util::SUIDManager.expects(:initgroups).in_sequence(when_root)
         Process.expects(:euid=).in_sequence(when_root)
 
         Puppet::Util::SUIDManager.change_user(50, false)
       end
     end
   end
 
   describe "when running commands" do
     before :each do
       # We want to make sure $CHILD_STATUS is set
       Kernel.system '' if $CHILD_STATUS.nil?
     end
 
     describe "with #run_and_capture" do
       it "should capture the output and return process status" do
         Puppet::Util.
           expects(:execute).
           with('yay', :combine => true, :failonfail => false, :uid => user[:uid], :gid => user[:gid]).
           returns('output')
         output = Puppet::Util::SUIDManager.run_and_capture 'yay', user[:uid], user[:gid]
 
         output.first.should == 'output'
         output.last.should be_a(Process::Status)
       end
     end
   end
 end