diff --git a/templates/sudoers.freebsd.erb b/templates/sudoers.freebsd.erb
index 77de4f6..1cd94d1 100644
--- a/templates/sudoers.freebsd.erb
+++ b/templates/sudoers.freebsd.erb
@@ -1,119 +1,120 @@
 # file managed by puppet (unless config_file_replace=false)
 #
 ## sudoers file.
 ##
 ## This file MUST be edited with the 'visudo' command as root.
 ## Failure to use 'visudo' may result in syntax or file permission errors
 ## that prevent sudo from running.
 ##
 ## See the sudoers man page for the details on how to write a sudoers file.
 ##
 
 ##
 ## Host alias specification
 ##
 ## Groups of machines. These may include host names (optionally with wildcards),
 ## IP addresses, network numbers or netgroups.
 # Host_Alias    WEBSERVERS = www1, www2, www3
 
 ##
 ## User alias specification
 ##
 ## Groups of users.  These may consist of user names, uids, Unix groups,
 ## or netgroups.
 # User_Alias    ADMINS = millert, dowdy, mikef
 
 ##
 ## Cmnd alias specification
 ##
 ## Groups of commands.  Often used to group related commands together.
 # Cmnd_Alias    PROCESSES = /usr/bin/nice, /bin/kill, /usr/bin/renice, \
 #                           /usr/bin/pkill, /usr/bin/top
 # Cmnd_Alias    REBOOT = /sbin/halt, /sbin/reboot, /sbin/poweroff
 
 ##
 ## Defaults specification
 ##
 ## Uncomment if needed to preserve environmental variables related to the
 ## FreeBSD pkg utility and fetch.
 # Defaults     env_keep += "PKG_CACHEDIR PKG_DBDIR FTP_PASSIVE_MODE"
 ##
 ## Additionally uncomment if needed to preserve environmental variables
 ## related to portupgrade
 # Defaults     env_keep += "PORTSDIR PORTS_INDEX PORTS_DBDIR PACKAGES PKGTOOLS_CONF"
 ##
 ## You may wish to keep some of the following environment variables
 ## when running commands via sudo.
 ##
 ## Locale settings
 # Defaults env_keep += "LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET"
 ##
 ## Run X applications through sudo; HOME is used to find the
 ## .Xauthority file.  Note that other programs use HOME to find
 ## configuration files and this may lead to privilege escalation!
 # Defaults env_keep += "HOME"
 ##
 ## X11 resource path settings
 # Defaults env_keep += "XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH"
 ##
 ## Desktop path settings
 # Defaults env_keep += "QTDIR KDEDIR"
 ##
 ## Allow sudo-run commands to inherit the callers' ConsoleKit session
 # Defaults env_keep += "XDG_SESSION_COOKIE"
 ##
 ## Uncomment to enable special input methods.  Care should be taken as
 ## this may allow users to subvert the command being run via sudo.
 # Defaults env_keep += "XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER"
 ##
 ## Uncomment to use a hard-coded PATH instead of the user's to find commands
 # Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/puppetlabs/bin"
 ##
 ## Uncomment to send mail if the user does not enter the correct password.
 # Defaults mail_badpass
 ##
 ## Uncomment to enable logging of a command's output, except for
 ## sudoreplay and reboot.  Use sudoreplay to play back logged sessions.
 # Defaults log_output
 # Defaults!/usr/bin/sudoreplay !log_output
 # Defaults!/usr/local/bin/sudoreplay !log_output
 # Defaults!REBOOT !log_output
 
 <% if @use_sudoreplay %>
 Defaults log_output
 Defaults!/usr/local/bin/sudoreplay !log_output
+<% if @sudoreplay_discard %>
 <% @sudoreplay_discard.each do |command| -%>
 Defaults!<%= command %> !log_output
 <% end -%>
 <% end -%>
-
+<% end -%>
 
 ##
 ## Runas alias specification
 ##
 
 ##
 ## User privilege specification
 ##
 root ALL=(ALL) ALL
 
 ## Uncomment to allow members of group wheel to execute any command
 # %wheel ALL=(ALL) ALL
 
 ## Same thing without a password
 # %wheel ALL=(ALL) NOPASSWD: ALL
 
 ## Uncomment to allow members of group sudo to execute any command
 # %sudo ALL=(ALL) ALL
 
 ## Uncomment to allow any user to run sudo if they know the password
 ## of the user they are running the command as (root by default).
 # Defaults targetpw  # Ask for the password of the target user
 # ALL ALL=(ALL) ALL  # WARNING: only use this together with 'Defaults targetpw'
 
 ## Read drop-in files
 ## (the '#' here does not indicate a comment)
 #includedir <%= @config_dir %>
 <% @extra_include_dirs.each do |include_dir| -%>
 #includedir <%= include_dir %>
 <% end if @extra_include_dirs -%>
diff --git a/templates/sudoers.rhel7.erb b/templates/sudoers.rhel7.erb
index 71a0308..92b7fd0 100644
--- a/templates/sudoers.rhel7.erb
+++ b/templates/sudoers.rhel7.erb
@@ -1,124 +1,126 @@
 # file managed by puppet (unless config_file_replace=false)
 #
 ## Sudoers allows particular users to run various commands as
 ## the root user, without needing the root password.
 ##
 ## Examples are provided at the bottom of the file for collections
 ## of related commands, which can then be delegated out to particular
 ## users or groups.
 ## 
 ## This file must be edited with the 'visudo' command.
 
 ## Host Aliases
 ## Groups of machines. You may prefer to use hostnames (perhaps using 
 ## wildcards for entire domains) or IP addresses instead.
 # Host_Alias     FILESERVERS = fs1, fs2
 # Host_Alias     MAILSERVERS = smtp, smtp2
 
 ## User Aliases
 ## These aren't often necessary, as you can use regular groups
 ## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname 
 ## rather than USERALIAS
 # User_Alias ADMINS = jsmith, mikem
 
 
 ## Command Aliases
 ## These are groups of related commands...
 
 ## Networking
 # Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
 
 ## Installation and management of software
 # Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
 
 ## Services
 # Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig, /usr/bin/systemctl start, /usr/bin/systemctl stop, /usr/bin/systemctl reload, /usr/bin/systemctl restart, /usr/bin/systemctl status, /usr/bin/systemctl enable, /usr/bin/systemctl disable
 
 ## Updating the locate database
 # Cmnd_Alias LOCATE = /usr/bin/updatedb
 
 ## Storage
 # Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
 
 ## Delegating permissions
 # Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 
 
 ## Processes
 # Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
 
 ## Drivers
 # Cmnd_Alias DRIVERS = /sbin/modprobe
 
 # Defaults specification
 
 # Refuse to run if unable to disable echo on the tty. This setting should also be
 # changed in order to be able to use sudo without a tty. See requiretty above.
 #
 Defaults   !visiblepw
 
 #
 # Preserving HOME has security implications since many programs
 # use it when searching for configuration files. Note that HOME
 # is already set when the the env_reset option is enabled, so
 # this option is only effective for configurations where either
 # env_reset is disabled or HOME is present in the env_keep list.
 #
 Defaults    always_set_home
 
 Defaults    env_reset
 Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"
 Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
 Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
 Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
 Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
 
 <% if @use_sudoreplay %>
 Defaults log_output
 Defaults!/usr/bin/sudoreplay !log_output
+<% if @sudoreplay_discard %>
 <% @sudoreplay_discard.each do |command| -%>
 Defaults!<%= command %> !log_output
 <% end -%>
 <% end -%>
+<% end -%>
 
 #
 # Adding HOME to env_keep may enable a user to run unrestricted
 # commands via sudo.
 #
 # Defaults   env_keep += "HOME"
 
 Defaults    secure_path = /usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/opt/puppetlabs/bin
 
 ## Next comes the main part: which users can run what software on 
 ## which machines (the sudoers file can be shared between multiple
 ## systems).
 ## Syntax:
 ##
 ## 	user	MACHINE=COMMANDS
 ##
 ## The COMMANDS section may have other options added to it.
 ##
 ## Allow root to run any commands anywhere 
 root	ALL=(ALL) 	ALL
 
 ## Allows members of the 'sys' group to run networking, software, 
 ## service management apps and more.
 # %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
 
 ## Allows people in group wheel to run all commands
 %wheel	ALL=(ALL)	ALL
 
 ## Same thing without a password
 # %wheel	ALL=(ALL)	NOPASSWD: ALL
 
 ## Allows members of the users group to mount and unmount the 
 ## cdrom as root
 # %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
 
 ## Allows members of the users group to shutdown this system
 # %users  localhost=/sbin/shutdown -h now
 
 ## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
 #includedir <%= @config_dir %>
 <% @extra_include_dirs.each do |include_dir| -%>
 #includedir <%= include_dir %>
 <% end if @extra_include_dirs -%>