Become without setting a password
As of Ansible 2.8,becomecan be used to become a Windows local or domain account
without requiring a password for that account. For this method to work, the
following requirements must be met:
The connection user has theSeDebugPrivilegeprivilege assignedThe connection user is part of theBUILTIN\AdministratorsgroupThebecome_userhas either theSeBatchLogonRightorSeNetworkLogonRightuser right
Using become without a password is achieved in one of two different methods:
Duplicating an existing logon session’s token if the account is already logged onUsing S4U to generate a logon token that is valid on the remote host only
In the first scenario, the become process is spawned from another logon of that
user account. This could be an existing RDP logon, console logon, but this is
not guaranteed to occur all the time. This is similar to theRunonlywhenuserisloggedonoption for a Scheduled Task.
In the case where another logon of the become account does not exist, S4U is
used to create a new logon and run the module through that. This is similar to
theRunwhetheruserisloggedonornotwith theDonotstorepasswordoption for a Scheduled Task. In this scenario, the become process will not be
able to access any network resources like a normal WinRM process.