win_user_right – Manage Windows User Rights¶
New in version 2.4.
Synopsis¶
Add, remove or set User Rights for a group or users or groups.
You can set user rights for both local and domain accounts.
Parameters¶
| Parameter | Choices/Defaults | Comments |
|---|---|---|
|
action
string
|
|
add will add the users/groups to the existing right.remove will remove the users/groups from the existing right.set will replace the users/groups of the existing right. |
|
name
string
/ required
|
The name of the User Right as shown by the
Constant Name value from https://technet.microsoft.com/en-us/library/dd349804.aspx.The module will return an error if the right is invalid.
|
|
|
users
list
/ required
|
A list of users or groups to add/remove on the User Right.
These can be in the form DOMAIN\user-group, [email protected] for domain users/groups.
For local users/groups it can be in the form user-group, .\user-group, SERVERNAME\user-group where SERVERNAME is the name of the remote server.
You can also add special local accounts like SYSTEM and others.
|
Notes¶
Note
If the server is domain joined this module can change a right but if a GPO governs this right then the changes won’t last.
See Also¶
See also
- win_group – Add and remove local groups
The official documentation on the win_group module.
- win_group_membership – Manage Windows local group membership
The official documentation on the win_group_membership module.
- win_user – Manages local Windows user accounts
The official documentation on the win_user module.
Examples¶
---
- name: Replace the entries of Deny log on locally
win_user_right:
name: SeDenyInteractiveLogonRight
users:
- Guest
- Users
action: set
- name: Add account to Log on as a service
win_user_right:
name: SeServiceLogonRight
users:
- .\Administrator
- '{{ansible_hostname}}\local-user'
action: add
- name: Remove accounts who can create Symbolic links
win_user_right:
name: SeCreateSymbolicLinkPrivilege
users:
- SYSTEM
- Administrators
- DOMAIN\User
- [email protected]
action: remove
Return Values¶
Common return values are documented here, the following are the fields unique to this module:
| Key | Returned | Description |
|---|---|---|
|
added
list
|
success |
A list of accounts that were added to the right, this is empty if no accounts were added.
Sample:
['NT AUTHORITY\\SYSTEM', 'DOMAIN\\User']
|
|
removed
list
|
success |
A list of accounts that were removed from the right, this is empty if no accounts were removed.
Sample:
['SERVERNAME\\Administrator', 'BUILTIN\\Administrators']
|
Status¶
This module is not guaranteed to have a backwards compatible interface. [preview]
This module is maintained by the Ansible Community. [community]