win_user_right - Manage Windows User Rights

New in version 2.4.

Synopsis
Parameters
Notes
Examples
Return Values
Status
- Author

Synopsis

Add, remove or set User Rights for a group or users or groups.
You can set user rights for both local and domain accounts.

Parameters

Parameter	Choices/Defaults	Comments
action	Choices: set ← add remove	`add` will add the users/groups to the existing right. `remove` will remove the users/groups from the existing right. `set` will replace the users/groups of the existing right.
name required		The name of the User Right as shown by the `Constant Name` value from https://technet.microsoft.com/en-us/library/dd349804.aspx. The module will return an error if the right is invalid.
users required		A list of users or groups to add/remove on the User Right. These can be in the form DOMAIN\user-group, [email protected] for domain users/groups. For local users/groups it can be in the form user-group, .\user-group, SERVERNAME\user-group where SERVERNAME is the name of the remote server. You can also add special local accounts like SYSTEM and others.

Notes

Note

If the server is domain joined this module can change a right but if a GPO governs this right then the changes won’t last.

Examples

---
- name: replace the entries of Deny log on locally
  win_user_right:
    name: SeDenyInteractiveLogonRight
    users:
    - Guest
    - Users
    action: set

- name: add account to Log on as a service
  win_user_right:
    name: SeServiceLogonRight
    users:
    - .\Administrator
    - '{{ansible_hostname}}\local-user'
    action: add

- name: remove accounts who can create Symbolic links
  win_user_right:
    name: SeCreateSymbolicLinkPrivilege
    users:
    - SYSTEM
    - Administrators
    - DOMAIN\User
    - [email protected]
    action: remove

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
added list	success	A list of accounts that were added to the right, this is empty if no accounts were added. Sample: ['NT AUTHORITY\\SYSTEM', 'DOMAIN\\User']
removed list	success	A list of accounts that were removed from the right, this is empty if no accounts were removed. Sample: ['SERVERNAME\\Administrator', 'BUILTIN\\Administrators']

Status

This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface.

Author

Jordan Borean (@jborean93)

Hint

If you notice any issues in this documentation you can edit this document to improve it.

© 2012–2018 Michael DeHaan
© 2018–2019 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.5/modules/win_user_right_module.html