Answers: <p>My problem resolves down to an issue with group policy, and is likely to be solved with the same answer as this question:</p>
  
  <p><a href="https://serverfault.com/questions/695839/error-1385-when-executing-runas-on-windows-enterprise-7">https://serverfault.com/questions/695839/error-1385-when-executing-runas-on-windows-enterprise-7</a></p>
  
  <p>i.e. the required permissions for <code>become</code> to work on Windows, seem to be:</p>
  
  <ul>
  <li>Allow Logon as a Service</li>
  <li>Allow Logon Locally</li>
  </ul>
  
  <h3>Alternate Solution</h3>
  
  <p><a href="https://docs.ansible.com/ansible/2.5/user_guide/become.html#become-and-windows" rel="nofollow noreferrer">reference</a></p>
  
  <blockquote>
    <p>batch: Runs the process under a batch context that is similar to a
    scheduled task with a password set. This should bypass most WinRM
    restrictions and is useful if the become_user is not allowed to log on
    interactively.</p>
  </blockquote>
  
  <p>There is another permission called 'Allow Logon as a Batch Job". If the domain-user has this permission, the user can run scripts as though they were scheduled tasks.</p>
  
  <p>You can run your scripts using Ansible <code>become</code> and change the logon type to <code>batch</code> as shown below: </p>
  
  <pre><code>win_whoami:
      become: yes
      become_user: ''SOMEDOMAIN\SOMEUSER''
      become_method: runas
      become_flags: logon_type=batch
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2018-05-23T06:05:26.057Z
Answers: 2018-05-24T06:41:30.150Z
Answers: 2018-05-24T06:41:30.150Z
Answers: Vish
Answers: <p>I found the issue be that the "Secondary Logon" service had been disabled.  Enabling it and running the Ansible playbook again worked.</p>
  
  <p>I found the suggestion on this blog post:
  <a href="http://david-homer.blogspot.com/2018/01/pinvoke-createprocesswithlogonw-causes.html" rel="nofollow noreferrer">http://david-homer.blogspot.com/2018/01/pinvoke-createprocesswithlogonw-causes.html</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2019-11-14T20:34:29.900Z
Answers: 2019-11-14T20:34:29.900Z
Answers: Jon Tucich
Body: <p>I am running several tasks on a Windows 2016 server with Ansible including:</p>
  
  <ul>
  <li>Joining it to a domain <code>SOMEDOMAIN</code></li>
  <li><code>SOMEDOMAIN\SOMEUSER</code> has been added to the local administrators group on the machine with Ansible.</li>
  <li>Running several tasks on the domain-connected machine as a domain-user <code>SOMEDOMAIN\SOMEUSER</code></li>
  </ul>
  
  <p>The last bit requires me to run Ansible tasks using <code>become</code> and <code>runas</code> (as per the <a href="http://docs.ansible.com/ansible/latest/user_guide/become.html#become-and-windows" rel="nofollow noreferrer">Ansible Documentation</a> on the topic). </p>
  
  <h2>Problem</h2>
  
  <p>Unfortunately, even a trivial example like the below fails:</p>
  
  <pre><code>---
  - name: add to local admin
    hosts: all
    vars:
      ansible_become_password: `some_password`
    tasks:
    - win_whoami:
      become: yes
      become_user: ''SOMEDOMAIN\SOMEUSER''
      become_method: runas
  </code></pre>
  
  <p>The error message reads </p>
  
  <pre><code>The full traceback is:
  Exception calling "RunAsUser" with "7" argument(s): "LogonUser failed (Logon failure: the user has not been granted
  the requested logon type at this computer, Win32ErrorCode 1385)"
  At line:1087 char:9
  +         $result = [Ansible.BecomeUtil]::RunAsUser($username, $passwor ...
  +         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
      + FullyQualifiedErrorId : Win32Exception
  
  
  fatal: [SERVERNAME]: FAILED! =&gt; {
      "changed": false,
      "msg": "Failed to become user SOMEDOMAIN\\SOMEUSER: Exception calling \"RunAsUser\" with \"7\" argument(s): \"LogonUser failed (Logon failure: the user has not been granted the requested logon type at this computer, Win32ErrorCode 1385)\""
  }
  </code></pre>
  
  <h2>Attempts</h2>
  
  <ul>
  <li>I do understand this is related to a privilege missing on the machine.</li>
  <li>I also know that group policies get applied on the machine when it joins the domain, so its possibly something related to the group policy. (I don't have access to the domain controller to validate this)</li>
  </ul>
  
  <p>I checked the Group Policy "Access this computer from the Network". It is set to <code>Everyone, Administrators, Backup Operators, Users</code> which is the default setting. My account is part of the <code>Administrators</code> group, so this doesn't look like the cause.</p>
  
  <h2>The Question</h2>
  
  <p>What other possible causes are there? Or in other words, what other privileges (or modifications to the ansible task) are needed to make Ansible <code>become</code> with the <code>runas</code> method work on domain-connected Windows machines?</p>
  
Tags: <ansible><windows><active-directory>
Title: problems running Ansible with become on domain-connected Windows Server
UserDisplayName: Vish
ThreadText: # problems running Ansible with become on domain-connected Windows Server
  
  (Asked by: username_0 on 2018-05-23)
  
  I am running several tasks on a Windows 2016 server with Ansible including:
  
  * Joining it to a domain `SOMEDOMAIN`
  * `SOMEDOMAIN\SOMEUSER` has been added to the local administrators group on the machine with Ansible.
  * Running several tasks on the domain-connected machine as a domain-user `SOMEDOMAIN\SOMEUSER`
  
  The last bit requires me to run Ansible tasks using `become` and `runas` (as per the [Ansible Documentation](http://docs.ansible.com/ansible/latest/user_guide/become.html#become-and-windows) on the topic).
  
  ## Problem
  
  Unfortunately, even a trivial example like the below fails:
  
  ```
  ---
  - name: add to local admin
    hosts: all
    vars:
      ansible_become_password: `some_password`
    tasks:
    - win_whoami:
      become: yes
      become_user: ''SOMEDOMAIN\SOMEUSER''
      become_method: runas
  
  ```
  
  The error message reads
  
  ```
  The full traceback is:
  Exception calling "RunAsUser" with "7" argument(s): "LogonUser failed (Logon failure: the user has not been granted
  the requested logon type at this computer, Win32ErrorCode 1385)"
  At line:1087 char:9
  +         $result = [Ansible.BecomeUtil]::RunAsUser($username, $passwor ...
  +         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
      + FullyQualifiedErrorId : Win32Exception
  
  fatal: [SERVERNAME]: FAILED! => {
      "changed": false,
      "msg": "Failed to become user SOMEDOMAIN\\SOMEUSER: Exception calling \"RunAsUser\" with \"7\" argument(s): \"LogonUser failed (Logon failure: the user has not been granted the requested logon type at this computer, Win32ErrorCode 1385)\""
  }
  
  ```
  
  ## Attempts
  
  * I do understand this is related to a privilege missing on the machine.
  * I also know that group policies get applied on the machine when it joins the domain, so its possibly something related to the group policy. (I don't have access to the domain controller to validate this)
  
  I checked the Group Policy "Access this computer from the Network". It is set to `Everyone, Administrators, Backup Operators, Users` which is the default setting. My account is part of the `Administrators` group, so this doesn't look like the cause.
  
  ## The Question
  
  What other possible causes are there? Or in other words, what other privileges (or modifications to the ansible task) are needed to make Ansible `become` with the `runas` method work on domain-connected Windows machines?
  
  **Tags:** ansible, windows, active-directory
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2018-05-23. Score: 2 | Accepted answer
  
  My problem resolves down to an issue with group policy, and is likely to be solved with the same answer as this question:
  
  <https://serverfault.com/questions/695839/error-1385-when-executing-runas-on-windows-enterprise-7>
  
  i.e. the required permissions for `become` to work on Windows, seem to be:
  
  * Allow Logon as a Service
  * Allow Logon Locally
  
  ### Alternate Solution
  
  [reference](https://docs.ansible.com/ansible/2.5/user_guide/become.html#become-and-windows)
  
  > batch: Runs the process under a batch context that is similar to a
  > scheduled task with a password set. This should bypass most WinRM
  > restrictions and is useful if the become\_user is not allowed to log on
  > interactively.
  
  There is another permission called 'Allow Logon as a Batch Job". If the domain-user has this permission, the user can run scripts as though they were scheduled tasks.
  
  You can run your scripts using Ansible `become` and change the logon type to `batch` as shown below:
  
  ```
  win_whoami:
      become: yes
      become_user: ''SOMEDOMAIN\SOMEUSER''
      become_method: runas
      become_flags: logon_type=batch
  
  ```
  
  
  ---
  
  ### Answer by username_1 on 2019-11-14. Score: 0
  
  I found the issue be that the "Secondary Logon" service had been disabled. Enabling it and running the Ansible playbook again worked.
  
  I found the suggestion on this blog post:
  <http://david-homer.blogspot.com/2018/01/pinvoke-createprocesswithlogonw-causes.html>
  
  
  ---
  
  