You are reading an unmaintained version of the Ansible documentation. Unmaintained Ansible versions can contain unfixed security vulnerabilities (CVE). Please upgrade to a maintained version. See the latest Ansible documentation.

win_user_right - Manage Windows User Rights¶

New in version 2.4.

Synopsis
Options
Examples
Return Values
Notes
- Status

Synopsis ¶

Add, remove or set User Rights for a group or users or groups.
You can set user rights for both local and domain accounts.

Options ¶

parameter	required	default	choices	comments
action	no	set	set add remove	`add` will add the users/groups to the existing right. `remove` will remove the users/groups from the existing right. `set` will replace the users/groups of the existing right.
name	yes			The name of the User Right as shown by the `Constant Name` value from https://technet.microsoft.com/en-us/library/dd349804.aspx. The module will return an error if the right is invalid.
users	yes			A list of users or groups to add/remove on the User Right. These can be in the form DOMAIN\user-group, user-group@DOMAIN.COM for domain users/groups. For local users/groups it can be in the form user-group, .\user-group, SERVERNAME\user-group where SERVERNAME is the name of the remote server. You can also add special local accounts like SYSTEM and others.

Examples ¶

---
- name: replace the entries of Deny log on locally
  win_user_right:
    name: SeDenyInteractiveLogonRight
    users:
    - Guest
    - Users
    action: set

- name: add account to Log on as a service
  win_user_right:
    name: SeServiceLogonRight
    users:
    - .\Administrator
    - '{{ansible_hostname}}\local-user'
    action: add

- name: remove accounts who can create Symbolic links
  win_user_right:
    name: SeCreateSymbolicLinkPrivilege
    users:
    - SYSTEM
    - Administrators
    - DOMAIN\User
    - group@DOMAIN.COM
    action: remove

Return Values ¶

Common return values are documented here Return Values, the following are the fields unique to this module:

name	description	returned	type	sample
added	A list of accounts that were added to the right, this is empty if no accounts were added.	success	list	['NT AUTHORITY\\SYSTEM', 'DOMAIN\\User']
removed	A list of accounts that were removed from the right, this is empty if no accounts were removed.	success	list	['SERVERNAME\\Administrator', 'BUILTIN\\Administrators']

Notes ¶

Note

If the server is domain joined this module can change a right but if a GPO governs this right then the changes won’t last.

Status ¶

This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface.

For help in developing on modules, should you be so inclined, please read Community Information & Contributing, Testing Ansible and Developing Modules.