Administrative rights
Many tasks in Windows require administrative privileges to complete. When using
therunasbecome method, Ansible will attempt to run the module with the
full privileges that are available to the become user. If it fails to elevate
the user token, it will continue to use the limited token during execution.
A user must have theSeDebugPrivilegeto run a become process with elevated
privileges. This privilege is assigned to Administrators by default. If the
debug privilege is not available, the become process will run with a limited
set of privileges and groups.
To determine the type of token that Ansible was able to get, run the following
task:
The output will look something similar to the below:
Under thelabelkey, theaccount_nameentry determines whether the user
has Administrative rights. Here are the labels that can be returned and what
they represent:
Medium: Ansible failed to get an elevated token and ran under a limited
token. Only a subset of the privileges assigned to the user are available during
the module execution and the user does not have administrative rights.High: An elevated token was used and all the privileges assigned to the
user are available during the module execution.System: TheNTAUTHORITY\Systemaccount is used and has the highest
level of privileges available.