win_user_right – Manage Windows User Rights

New in version 2.4.

Synopsis

• Add, remove or set User Rights for a group or users or groups.

• You can set user rights for both local and domain accounts.

Parameters

Parameter	Choices/Defaults	Comments
action string	Choices: add remove set ←	add will add the users/groups to the existing right. remove will remove the users/groups from the existing right. set will replace the users/groups of the existing right.
name string / required		The name of the User Right as shown by the Constant Name value from users list / required		A list of users or groups to add/remove on the User Right. These can be in the form DOMAIN\user-group, user-group@DOMAIN.COM for domain users/groups. For local users/groups it can be in the form user-group, .\user-group, SERVERNAME\user-group where SERVERNAME is the name of the remote server. You can also add special local accounts like SYSTEM and others. Can be set to an empty list with action=set to remove all accounts from the right.

Notes

Note

• If the server is domain joined this module can change a right but if a GPO governs this right then the changes won’t last.

See Also

See also

win_group – Add and remove local groups

The official documentation on the win_group module.

win_group_membership – Manage Windows local group membership

The official documentation on the win_group_membership module.

win_user – Manages local Windows user accounts

The official documentation on the win_user module.

Examples

---
- name: Replace the entries of Deny log on locally
  win_user_right:
    name: SeDenyInteractiveLogonRight
    users:
    - Guest
    - Users
    action: set

- name: Add account to Log on as a service
  win_user_right:
    name: SeServiceLogonRight
    users:
    - .\Administrator
    - '{{ansible_hostname}}\local-user'
    action: add

- name: Remove accounts who can create Symbolic links
  win_user_right:
    name: SeCreateSymbolicLinkPrivilege
    users:
    - SYSTEM
    - Administrators
    - DOMAIN\User
    - group@DOMAIN.COM
    action: remove

- name: Remove all accounts who cannot log on remote interactively
  win_user_right:
    name: SeDenyRemoteInteractiveLogonRight
    users: []

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
added list	success	A list of accounts that were added to the right, this is empty if no accounts were added. Sample: ['NT AUTHORITY\\SYSTEM', 'DOMAIN\\User']
removed list	success	A list of accounts that were removed from the right, this is empty if no accounts were removed. Sample: ['SERVERNAME\\Administrator', 'BUILTIN\\Administrators']

Status

• This module is not guaranteed to have a backwards compatible interface. [preview]

• This module is maintained by the Ansible Community. [community]

Authors

• Jordan Borean (@jborean93)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.