(GH-1755) Add new DSC resource to manage SecurityPolicy

.github/skills/code-review/security.instructions.md

@@ -1,5 +1,5 @@
 ---
-applyTo: 'lib/dsc-lib/src/util.rs,lib/dsc-lib-security_context/**,lib/dsc-lib-registry/**,resources/registry/**,resources/windows_firewall/**,resources/windows_service/**,resources/dism_dsc/**'
+applyTo: 'lib/dsc-lib/src/util.rs,lib/dsc-lib-security_context/**,lib/dsc-lib-registry/**,resources/registry/**,resources/windows_firewall/**,resources/windows_service/**,resources/windows_security_policy/**,resources/dism_dsc/**'
 description: 'Code review guidance for security-sensitive code (ACLs, policy, credentials, elevated resources)'
 ---
 

.github/skills/code-review/windows.instructions.md

@@ -1,5 +1,5 @@
 ---
-applyTo: 'resources/windows_firewall/**,resources/windows_service/**,resources/WindowsUpdate/**,resources/windows_personalization/**,resources/dism_dsc/**,resources/registry/**,lib/dsc-lib-registry/**,lib/dsc-lib-pal/**'
+applyTo: 'resources/windows_firewall/**,resources/windows_service/**,resources/windows_security_policy/**,resources/WindowsUpdate/**,resources/windows_personalization/**,resources/dism_dsc/**,resources/registry/**,lib/dsc-lib-registry/**,lib/dsc-lib-pal/**'
 description: 'Code review guidance for Windows-specific code (FFI, COM, registry, DISM, services)'
 ---
 

CHANGELOG.md

@@ -77,6 +77,20 @@ changes since the last release, see the [diff on GitHub][unreleased].
 
 ### Added
 
+- Added the `Microsoft.Windows/UserRightsAssignment` built-in resource for managing which accounts
+  hold a Windows user right or privilege (Local Security Policy > User Rights Assignment) natively
+  through the LSA account-rights APIs, as the first part of a replacement for the
+  `SecurityPolicyDsc` PowerShell module. Identities can be given as names or SIDs, the
+  `setAction` property chooses between replacing, adding or removing holders, and the resource
+  supports `get`, `set`, `test`, `export`, and `--what-if`.
+
+  <details><summary>Related work items</summary>
+
+  - Issues: [#1755][#1755]
+  - PRs: [#1759][#1759]
+
+  </details>
+
 - Added what-if support to the MCP server tools. The `invoke_dsc_config` tool now accepts a
   `what_if` option for the `set` operation, and the `invoke_dsc_resource` tool accepts `what_if`
   for the `set` and `delete` operations. This mirrors the `--what-if` flag on the `dsc config set`,
@@ -2000,4 +2014,6 @@ Version `3.0.0` is the first generally available release of DSC.
 [#1558]: https://github.com/PowerShell/DSC/issues/1558
 [#1562]: https://github.com/PowerShell/DSC/issues/1562
 [#1729]: https://github.com/PowerShell/DSC/issues/1729
+[#1755]: https://github.com/PowerShell/DSC/issues/1755
+[#1759]: https://github.com/PowerShell/DSC/issues/1759
 

Cargo.toml

@@ -27,6 +27,7 @@ members = [
     "resources/windows_service",
     "resources/WindowsUpdate",
     "resources/environment_variable",
+    "resources/windows_security_policy",
     "adapters/group_policy_template",
     "tools/dsctest",
     "tools/test_group_resource",
@@ -62,6 +63,7 @@ default-members = [
     "resources/windows_service",
     "resources/WindowsUpdate",
     "resources/environment_variable",
+    "resources/windows_security_policy",
     "adapters/group_policy_template",
     "tools/dsctest",
     "tools/test_group_resource",
@@ -98,6 +100,7 @@ Windows = [
     "resources/windows_service",
     "resources/WindowsUpdate",
     "resources/environment_variable",
+    "resources/windows_security_policy",
     "adapters/group_policy_template",
     "tools/dsctest",
     "tools/test_group_resource",
@@ -290,11 +293,12 @@ urlencoding = { version = "2.1" }
 which = { version = "8.0.6" }
 # dsc-lib
 ipnetwork = { version = "0.21" }
-# WindowsUpdate, windows_service, dsc-lib (ACL checks), dsc-lib-registry
+# WindowsUpdate, windows_service, windows_security_policy, dsc-lib (ACL checks), dsc-lib-registry
 windows = { version = "0.62", features = [
     "Win32_Foundation",
     "Win32_NetworkManagement_WindowsFirewall",
     "Win32_Security",
+    "Win32_Security_Authentication_Identity",
     "Win32_Security_Authorization",
     "Win32_System_Com",
     "Win32_System_Memory",

data.build.json

@@ -117,6 +117,8 @@
       "windows_firewall.exe",
       "windows_service.exe",
       "windows_service.dsc.resource.json",
+      "windows_security_policy.exe",
+      "windows_security_policy.dsc.manifests.json",
       "windows_feature.dsc.resource.json",
       "wmi.dsc.resource.json",
       "wmi.resource.ps1",