Comments (4)
That's interesting, RemovePrivilege
ends up calling LsaRemoveAccountRights. The default values for SeCreateGlobalPrivilege
indicate the following 4 accounts are set for this right
- BUILTIN\Administrators
- NT AUTHORITY\Local Service
- NT AUTHORITY\Network Service
- NT AUTHORITY\Service
Based on your example it should be trying to remove Network Service
and Service
and one of those is failing. Luckily I can replicate this locally so I'll need to play around a bit more and figure out what may be happening here.
from ansible.windows.
After further testing I think this is one of those cases where Windows does not allow you to remove certain accounts from a privilege. I've tried to remove NT AUTHORITY\Network Service
from either Create global objects (SeCreateGlobalPrivilege)
or Adjust memory quota for a process (SeIncreaseQuotaPrivilege)
from the UI with gpedit.msc
. While it doesn't actually display any errors and seems like the accounts are removed, as soon as I close and re-open gpedit.msc
the account is back there like it was never removed.
Are you also able to validate that's the case on your host by trying to remove Network Service
from the privilege you are trying to remove in your task?
It probably would be a good idea to improve the error message to include the privilege(s) it was trying to remove though so I'll keep this issue opened until that is implemented.
from ansible.windows.
@jborean93 you are right, Windows adds Network Service again every time.. so I guess that's the issue. The OS doesn't like PS to remove that privilege. I will make a few more tests, but probably that's what's this is all about..
Thanks for your time.
from ansible.windows.
So while it doesn't fix the issue, which we can do nothing about, #91 has been merged which changes the error message in this scenario to now become
TASK [win_user_right] ********************************************************************************************************
task path: /home/jborean/dev/ansible-tester/main.yml:5
redirecting (type: modules) ansible.builtin.win_user_right to ansible.windows.win_user_right
Using module file /home/jborean/dev/ansible_collections/ansible/windows/plugins/modules/win_user_right.ps1
Pipelining is enabled.
<server2019.domain.local> ESTABLISH PSRP CONNECTION FOR USER: [email protected] ON PORT 5985 TO server2019.domain.local
PSRP: EXEC (via pipeline wrapper)
The full traceback is:
The request is not supported
At line:396 char:13
+ $lsaHelper.RemovePrivilege($sid, $name)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], Win32Exception
+ FullyQualifiedErrorId : Win32Exception
ScriptStackTrace:
at <ScriptBlock>, <No file>: line 396
fatal: [2019]: FAILED! => changed=false
added: []
diff:
after: ''
before:
SeCreateGlobalPrivilege:
- NT AUTHORITY\SERVICE
- BUILTIN\Administrators
- NT AUTHORITY\NETWORK SERVICE
- NT AUTHORITY\LOCAL SERVICE
invocation:
module_args:
action: remove
name: SeCreateGlobalPrivilege
users:
- Network Service
msg: 'Failed to remove account NT AUTHORITY\NETWORK SERVICE from right SeCreateGlobalPrivilege: The request is not supported'
removed: []
The error message shows the account name that was attempted to be removed and from what right.
from ansible.windows.
Related Issues (20)
- win_environment : Maybe add an option to read variable content ? HOT 6
- Error during machine sid retrieval: An error (1788) occurred while enumerating the group membership. The member's SID could not be resolved. HOT 8
- Access denied after renaming windows host : Server not found in Kerberos database HOT 10
- Failed to create temporary directory when running win_template module against Windows Server 2019 HOT 10
- win_copy doesnt work when folder name has special character HOT 3
- Add account_expires functionality from the Set-LocalUser PowerShell Cmdlet HOT 2
- Using Machine credentials from AAP passed to playbook with ansible.windows.win_copy fails HOT 3
- ERROR DURING WINRM SEND INPUT - attempting to recover: WinRMTransportError Bad HTTP response returned from server. Code 413 HOT 2
- win_copy module not handling an invalid path correctly. HOT 2
- Feature request: A better win_acl module HOT 1
- Error in Windows Update: Unhandled exception while executing module: Cannot process request because the process (PID) has exited HOT 4
- Docs for setup reference ansible.builtin instead of ansible.windows
- Instances of ansible.builtin instead of ansible.windows in docs for overloaded module names
- Galaxy Download does not work HOT 1
- win_powershell sensitive parameters using `::new()` HOT 1
- ansible.windows.win_owner module fails to run recursively if ansible_user does not have access to the child items HOT 2
- Not able to run the win_update task on Windows server when Trellix Threat prevention enabled with Ansible version 2.16.6 HOT 11
- Unable to Install 'VirtualMachinePlatform' Feature on Windows Server 2022 using win_feature Module HOT 1
- win_updates: not find cumulative updates but appears on GUI HOT 4
- Error in win_stat when fetching a file with brackets [] in the name HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ansible.windows.