<p>My problem resolves down to an issue with group policy, and is likely to be solved with the same answer as this question:</p>

<p><a href="https://serverfault.com/questions/695839/error-1385-when-executing-runas-on-windows-enterprise-7">https://serverfault.com/questions/695839/error-1385-when-executing-runas-on-windows-enterprise-7</a></p>

<p>i.e. the required permissions for <code>become</code> to work on Windows, seem to be:</p>

<ul>
<li>Allow Logon as a Service</li>
<li>Allow Logon Locally</li>
</ul>

<h3>Alternate Solution</h3>

<p><a href="https://docs.ansible.com/ansible/2.5/user_guide/become.html#become-and-windows" rel="nofollow noreferrer">reference</a></p>

<blockquote>
  <p>batch: Runs the process under a batch context that is similar to a
  scheduled task with a password set. This should bypass most WinRM
  restrictions and is useful if the become_user is not allowed to log on
  interactively.</p>
</blockquote>

<p>There is another permission called 'Allow Logon as a Batch Job". If the domain-user has this permission, the user can run scripts as though they were scheduled tasks.</p>

<p>You can run your scripts using Ansible <code>become</code> and change the logon type to <code>batch</code> as shown below: </p>

<pre><code>win_whoami:
    become: yes
    become_user: ''SOMEDOMAIN\SOMEUSER''
    become_method: runas
    become_flags: logon_type=batch
</code></pre>

CC BY-SA 4.0
2018-05-23T06:05:26.057Z
2018-05-24T06:41:30.150Z
2018-05-24T06:41:30.150Z
Vish
<p>I found the issue be that the "Secondary Logon" service had been disabled.  Enabling it and running the Ansible playbook again worked.</p>

<p>I found the suggestion on this blog post:
<a href="http://david-homer.blogspot.com/2018/01/pinvoke-createprocesswithlogonw-causes.html" rel="nofollow noreferrer">http://david-homer.blogspot.com/2018/01/pinvoke-createprocesswithlogonw-causes.html</a></p>

CC BY-SA 4.0
2019-11-14T20:34:29.900Z
2019-11-14T20:34:29.900Z
Jon Tucich
<p>I am running several tasks on a Windows 2016 server with Ansible including:</p>

<ul>
<li>Joining it to a domain <code>SOMEDOMAIN</code></li>
<li><code>SOMEDOMAIN\SOMEUSER</code> has been added to the local administrators group on the machine with Ansible.</li>
<li>Running several tasks on the domain-connected machine as a domain-user <code>SOMEDOMAIN\SOMEUSER</code></li>
</ul>

<p>The last bit requires me to run Ansible tasks using <code>become</code> and <code>runas</code> (as per the <a href="http://docs.ansible.com/ansible/latest/user_guide/become.html#become-and-windows" rel="nofollow noreferrer">Ansible Documentation</a> on the topic). </p>

<h2>Problem</h2>

<p>Unfortunately, even a trivial example like the below fails:</p>

<pre><code>---
- name: add to local admin
  hosts: all
  vars:
    ansible_become_password: `some_password`
  tasks:
  - win_whoami:
    become: yes
    become_user: ''SOMEDOMAIN\SOMEUSER''
    become_method: runas
</code></pre>

<p>The error message reads </p>

<pre><code>The full traceback is:
Exception calling "RunAsUser" with "7" argument(s): "LogonUser failed (Logon failure: the user has not been granted
the requested logon type at this computer, Win32ErrorCode 1385)"
At line:1087 char:9
+         $result = [Ansible.BecomeUtil]::RunAsUser($username, $passwor ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : Win32Exception


fatal: [SERVERNAME]: FAILED! =&gt; {
    "changed": false,
    "msg": "Failed to become user SOMEDOMAIN\\SOMEUSER: Exception calling \"RunAsUser\" with \"7\" argument(s): \"LogonUser failed (Logon failure: the user has not been granted the requested logon type at this computer, Win32ErrorCode 1385)\""
}
</code></pre>

<h2>Attempts</h2>

<ul>
<li>I do understand this is related to a privilege missing on the machine.</li>
<li>I also know that group policies get applied on the machine when it joins the domain, so its possibly something related to the group policy. (I don't have access to the domain controller to validate this)</li>
</ul>

<p>I checked the Group Policy "Access this computer from the Network". It is set to <code>Everyone, Administrators, Backup Operators, Users</code> which is the default setting. My account is part of the <code>Administrators</code> group, so this doesn't look like the cause.</p>

<h2>The Question</h2>

<p>What other possible causes are there? Or in other words, what other privileges (or modifications to the ansible task) are needed to make Ansible <code>become</code> with the <code>runas</code> method work on domain-connected Windows machines?</p>

<ansible><windows><active-directory>
problems running Ansible with become on domain-connected Windows Server
Vish
# problems running Ansible with become on domain-connected Windows Server

(Asked by: username_0 on 2018-05-23)

I am running several tasks on a Windows 2016 server with Ansible including:

Joining it to a domain SOMEDOMAIN
SOMEDOMAIN\SOMEUSER has been added to the local administrators group on the machine with Ansible.
Running several tasks on the domain-connected machine as a domain-user SOMEDOMAIN\SOMEUSER

The last bit requires me to run Ansible tasks using become and runas (as per the Ansible Documentation on the topic). 
Problem
Unfortunately, even a trivial example like the below fails:
---
- name: add to local admin
  hosts: all
  vars:
    ansible_become_password: `some_password`
  tasks:
  - win_whoami:
    become: yes
    become_user: ''SOMEDOMAIN\SOMEUSER''
    become_method: runas

The error message reads 
The full traceback is:
Exception calling "RunAsUser" with "7" argument(s): "LogonUser failed (Logon failure: the user has not been granted
the requested logon type at this computer, Win32ErrorCode 1385)"
At line:1087 char:9
+         $result = [Ansible.BecomeUtil]::RunAsUser($username, $passwor ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : Win32Exception


fatal: [SERVERNAME]: FAILED! => {
    "changed": false,
    "msg": "Failed to become user SOMEDOMAIN\\SOMEUSER: Exception calling \"RunAsUser\" with \"7\" argument(s): \"LogonUser failed (Logon failure: the user has not been granted the requested logon type at this computer, Win32ErrorCode 1385)\""
}

Attempts

I do understand this is related to a privilege missing on the machine.
I also know that group policies get applied on the machine when it joins the domain, so its possibly something related to the group policy. (I don't have access to the domain controller to validate this)

I checked the Group Policy "Access this computer from the Network". It is set to Everyone, Administrators, Backup Operators, Users which is the default setting. My account is part of the Administrators group, so this doesn't look like the cause.
The Question
What other possible causes are there? Or in other words, what other privileges (or modifications to the ansible task) are needed to make Ansible become with the runas method work on domain-connected Windows machines?

**Tags:** ansible, windows, active-directory


---

## 2 answers

### Answer by username_0 on 2018-05-23. Score: 2 | Accepted answer

My problem resolves down to an issue with group policy, and is likely to be solved with the same answer as this question:
https://serverfault.com/questions/695839/error-1385-when-executing-runas-on-windows-enterprise-7
i.e. the required permissions for become to work on Windows, seem to be:

Allow Logon as a Service
Allow Logon Locally

Alternate Solution
reference

batch: Runs the process under a batch context that is similar to a
  scheduled task with a password set. This should bypass most WinRM
  restrictions and is useful if the become_user is not allowed to log on
  interactively.

There is another permission called 'Allow Logon as a Batch Job". If the domain-user has this permission, the user can run scripts as though they were scheduled tasks.
You can run your scripts using Ansible become and change the logon type to batch as shown below: 
win_whoami:
    become: yes
    become_user: ''SOMEDOMAIN\SOMEUSER''
    become_method: runas
    become_flags: logon_type=batch


---

### Answer by username_1 on 2019-11-14. Score: 0

I found the issue be that the "Secondary Logon" service had been disabled. Enabling it and running the Ansible playbook again worked.

I found the suggestion on this blog post:
<http://david-homer.blogspot.com/2018/01/pinvoke-createprocesswithlogonw-causes.html>


---

