When running Puppet manifests I'm trying to make sure that no errors are happening because Puppet apply doesn't return reliable exit codes all the time, hence looking in stderr. The ACL verification steps are reading the output from icacls to determine if the permissions are correct which prints to stdout.