problems running Ansible with become on domain-connected Windows Server

Question

I am running several tasks on a Windows 2016 server with Ansible including:

• Joining it to a domain SOMEDOMAIN
• SOMEDOMAIN\SOMEUSER has been added to the local administrators group on the machine with Ansible.
• Running several tasks on the domain-connected machine as a domain-user SOMEDOMAIN\SOMEUSER

The last bit requires me to run Ansible tasks using become and runas (as per the Ansible Documentation on the topic).

Problem

Unfortunately, even a trivial example like the below fails:

---
- name: add to local admin
  hosts: all
  vars:
    ansible_become_password: `some_password`
  tasks:
  - win_whoami:
    become: yes
    become_user: ''SOMEDOMAIN\SOMEUSER''
    become_method: runas

The error message reads

The full traceback is:
Exception calling "RunAsUser" with "7" argument(s): "LogonUser failed (Logon failure: the user has not been granted
the requested logon type at this computer, Win32ErrorCode 1385)"
At line:1087 char:9
+         $result = [Ansible.BecomeUtil]::RunAsUser($username, $passwor ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : Win32Exception


fatal: [SERVERNAME]: FAILED! => {
    "changed": false,
    "msg": "Failed to become user SOMEDOMAIN\\SOMEUSER: Exception calling \"RunAsUser\" with \"7\" argument(s): \"LogonUser failed (Logon failure: the user has not been granted the requested logon type at this computer, Win32ErrorCode 1385)\""
}

Attempts

• I do understand this is related to a privilege missing on the machine.
• I also know that group policies get applied on the machine when it joins the domain, so its possibly something related to the group policy. (I don't have access to the domain controller to validate this)

I checked the Group Policy "Access this computer from the Network". It is set to Everyone, Administrators, Backup Operators, Users which is the default setting. My account is part of the Administrators group, so this doesn't look like the cause.

The Question

What other possible causes are there? Or in other words, what other privileges (or modifications to the ansible task) are needed to make Ansible become with the runas method work on domain-connected Windows machines?

Answer 1

My problem resolves down to an issue with group policy, and is likely to be solved with the same answer as this question:

https://serverfault.com/questions/695839/error-1385-when-executing-runas-on-windows-enterprise-7

i.e. the required permissions for become to work on Windows, seem to be:

• Allow Logon as a Service
• Allow Logon Locally

Alternate Solution

reference

batch: Runs the process under a batch context that is similar to a scheduled task with a password set. This should bypass most WinRM restrictions and is useful if the become_user is not allowed to log on interactively.

There is another permission called 'Allow Logon as a Batch Job". If the domain-user has this permission, the user can run scripts as though they were scheduled tasks.

You can run your scripts using Ansible become and change the logon type to batch as shown below:

win_whoami:
    become: yes
    become_user: ''SOMEDOMAIN\SOMEUSER''
    become_method: runas
    become_flags: logon_type=batch

Answer 2

I found the issue be that the "Secondary Logon" service had been disabled. Enabling it and running the Ansible playbook again worked.

I found the suggestion on this blog post: http://david-homer.blogspot.com/2018/01/pinvoke-createprocesswithlogonw-causes.html