saltstack ensure a group have not members.md

salt-call --versions-report

root@saltmaster:/srv/salt/system/cis# salt-call --versions-report
Salt Version:
           Salt: 2018.3.2

Dependency Versions:
           cffi: Not Installed
       cherrypy: Not Installed
       dateutil: 2.4.2
      docker-py: Not Installed
          gitdb: 0.6.4
      gitpython: 1.0.1
          ioflo: Not Installed
         Jinja2: 2.8
        libgit2: Not Installed
        libnacl: Not Installed
       M2Crypto: Not Installed
           Mako: 1.0.3
   msgpack-pure: Not Installed
 msgpack-python: 0.4.6
   mysql-python: Not Installed
      pycparser: Not Installed
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: Not Installed
         Python: 2.7.12 (default, Dec  4 2017, 14:50:18)
   python-gnupg: 0.3.8
         PyYAML: 3.11
          PyZMQ: 15.2.0
           RAET: Not Installed
          smmap: 0.9.0
        timelib: Not Installed
        Tornado: 4.2.1
            ZMQ: 4.1.4

System Versions:
           dist: Ubuntu 16.04 xenial
         locale: UTF-8
        machine: x86_64
        release: 4.4.0-116-generic
         system: Linux
        version: Ubuntu 16.04 xenial

mysuperduper.sls

6.2.20 Ensure shadow group is empty (Scored):
  group.present:
    - name: shadow
    - members: []

I manually add a group in shadow group

root@minion1:~# getent group shadow
shadow:x:42:toto

I try to use the state to ensure shadow group have no members

salt 'minion1' state.apply

Result :

----------
          ID: 6.2.20 Ensure shadow group is empty (Scored)
    Function: group.present
        Name: shadow
      Result: True
     Comment: Group shadow is present and up to date
     Started: 01:53:26.420752
    Duration: 1.771 ms
     Changes:

Shadow group have the fake member again ...,

root@minion1:~# getent group shadow
shadow:x:42:toto

metabsd/saltstack ensure a group have not members.md