Become flags for Windows
Ansible 2.5 added thebecome_flagsparameter to therunasbecome method.
This parameter can be set using thebecome_flagstask directive or set in
Ansible’s configuration usingansible_become_flags. The two valid values
that are initially supported for this parameter arelogon_typeandlogon_flags.
The keylogon_typesets the type of logon operation to perform. The value
can be set to one of the following:
interactive: The default logon type. The process will be run under a
context that is the same as when running a process locally. This bypasses all
WinRM restrictions and is the recommended method to use.batch: Runs the process under a batch context that is similar to a
scheduled task with a password set. This should bypass most WinRM
restrictions and is useful if thebecome_useris not allowed to log on
interactively.new_credentials: Runs under the same credentials as the calling user, but
outbound connections are run under the context of thebecome_userandbecome_password, similar torunas.exe/netonly. Thelogon_flagsflag should also be set tonetcredentials_only. Use this flag if
the process needs to access a network resource (like an SMB share) using a
different set of credentials.network: Runs the process under a network context without any cached
credentials. This results in the same type of logon session as running a
normal WinRM process without credential delegation and operates under the same
restrictions.network_cleartext: Like thenetworklogon type, but instead caches
the credentials so it can access network resources. This is the same type of
logon session as running a normal WinRM process with credential delegation.
For more information, seedwLogonType.
Thelogon_flagskey specifies how Windows will log the user on when creating
the new process. The value can be set to none or multiple of the following:
with_profile: The default logon flag set. The process will load the
user’s profile in theHKEY_USERSregistry key toHKEY_CURRENT_USER.netcredentials_only: The process will use the same token as the caller
but will use thebecome_userandbecome_passwordwhen accessing a remote
resource. This is useful in inter-domain scenarios where there is no trust
relationship, and should be used with thenew_credentialslogon_type.