# "Access denied" error when running win\_updates module on Windows vSphere hosts

**URL:** <https://forum.ansible.com/t/access-denied-error-when-running-win-updates-module-on-windows-vsphere-hosts/4559>\
**Category:** Get Help\
**Tags:** windows, update, playbook\
**Created:** [March 25, 2024, 6:29pm UTC](https://forum.ansible.com/t/access-denied-error-when-running-win-updates-module-on-windows-vsphere-hosts/4559 "2024-03-25T18:29:00Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![krustwell](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/krustwell/32/2676_2.png) [@krustwell](https://forum.ansible.com/u/krustwell)\
**Post date:** [March 25, 2024, 6:29pm UTC](https://forum.ansible.com/t/access-denied-error-when-running-win-updates-module-on-windows-vsphere-hosts/4559/1 "2024-03-25T18:29:00Z")

</div>

ansible [core 2.13.7] on Rocky Linux 8.9 connecting to/configuring Windows Server 2022 Standard

I have a pretty boring playbook:

```auto
- name: Search security updates
  ansible.windows.win_updates:
    category_names:
      - SecurityUpdates
    state: searched
    log_path: D:\logs\ansible_wu.txt

```

It errors with the following:

```auto
The full traceback is:
Exception calling "NativeCreateProcess" with "9" argument(s): "CreateProcessW() failed (Access is denied, Win32ErrorCode 5 - 0x00000005)"
At line:2182 char:24
+ ... $taskPid = Invoke-InProcess @invokeSplat -ParentProcessId $parentPid ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotSpecified: (:) [Invoke-InProcess], MethodInvocationException
    + FullyQualifiedErrorId : Win32Exception,Invoke-InProcess

ScriptStackTrace:
at Invoke-InProcess, <No file>: line 490
at <ScriptBlock>, <No file>: line 2182
fatal: [SERVERNAME]: FAILED! => {
    "changed": false,
    "failed_update_count": 0,
    "filtered_updates": {},
    "found_update_count": 0,
    "installed_update_count": 0,
    "invocation": {
        "module_args": {
            "accept_list": null,
            "category_names": [
                "SecurityUpdates"
            ],
            "log_path": "D:\\logs\\ansible_wu.txt",
            "reboot": false,
            "reboot_timeout": 1200,
            "reject_list": null,
            "server_selection": "default",
            "skip_optional": false,
            "state": "searched"
        }
    },
    "msg": "Failed to start new win_updates task with Task Scheduler: Exception calling \"NativeCreateProcess\" with \"9\" argument(s): \"CreateProcessW() failed (Access is denied, Win32ErrorCode 5 - 0x00000005)\"",
    "updates": {}
}

```

Ansible can successfully connect to the server with win\_ping, win\_service\_info, etc.

Thank you in advance, and please let me know what other information I can provide.

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [March 25, 2024, 6:39pm UTC](https://forum.ansible.com/t/access-denied-error-when-running-win-updates-module-on-windows-vsphere-hosts/4559/2 "2024-03-25T18:39:04Z")

</div>

Looks like you need to use `become` to elevate your privileges, since that is a Windows permission error.

Edit: welcome to the forum by the way, saw your comment over in #Social Space .

Since you seem to be new to ansible, please review the documentation for `become` which can be found here:  
[Understanding privilege escalation: become — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_privilege_escalation.html#id16)

You can use `win_whoami` to see your user’s privileges, and make a debug playbook to test your user with and without become set.

```yaml
- hosts: windows
  gather_facts: true
  become_method: runas
  become_flags: logon_type=interactive
  become_user: "DOMAIN\Admin_user"
  tasks:
    - name: unprivileged
      win_whoami:
    - name: privileged
      win_whoami:
      become: true

```

Once you have `become` working, you should be able to run the windows updates task with sufficient privileges.

---

<div class="post-metadata">

**Author:** ![krustwell](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/krustwell/32/2676_2.png) [@krustwell](https://forum.ansible.com/u/krustwell)\
**Post date:** [March 25, 2024, 7:59pm UTC](https://forum.ansible.com/t/access-denied-error-when-running-win-updates-module-on-windows-vsphere-hosts/4559/3 "2024-03-25T19:59:20Z")

</div>

Thanks for the response.

I’m running the playbook as a domain service account with Administrator privileges. When I run win\_whoami (which I had previously done to verify permissions), it came back with seemingly everything it needs, hence my frustration:

```auto
    "privileges": {
        "SeBackupPrivilege": "enabled-by-default",
        "SeChangeNotifyPrivilege": "enabled-by-default",
        "SeCreateGlobalPrivilege": "enabled-by-default",
        "SeCreatePagefilePrivilege": "enabled-by-default",
        "SeCreateSymbolicLinkPrivilege": "enabled-by-default",
        "SeDebugPrivilege": "enabled-by-default",
        "SeDelegateSessionUserImpersonatePrivilege": "enabled-by-default",
        "SeImpersonatePrivilege": "enabled-by-default",
        "SeIncreaseBasePriorityPrivilege": "enabled-by-default",
        "SeIncreaseQuotaPrivilege": "enabled-by-default",
        "SeIncreaseWorkingSetPrivilege": "enabled-by-default",
        "SeLoadDriverPrivilege": "enabled-by-default",
        "SeManageVolumePrivilege": "enabled-by-default",
        "SeProfileSingleProcessPrivilege": "enabled-by-default",
        "SeRemoteShutdownPrivilege": "enabled-by-default",
        "SeRestorePrivilege": "enabled-by-default",
        "SeSecurityPrivilege": "enabled-by-default",
        "SeShutdownPrivilege": "enabled-by-default",
        "SeSystemEnvironmentPrivilege": "enabled-by-default",
        "SeSystemProfilePrivilege": "enabled-by-default",
        "SeSystemtimePrivilege": "enabled-by-default",
        "SeTakeOwnershipPrivilege": "enabled-by-default",
        "SeTimeZonePrivilege": "enabled-by-default",
        "SeUndockPrivilege": "enabled-by-default"
    },
    "rights": [
        "SeInteractiveLogonRight",
        "SeNetworkLogonRight",
        "SeBatchLogonRight",
        "SeRemoteInteractiveLogonRight"
    ],
    "token_type": "TokenPrimary",
    "upn": "",
    "user_flags": []
}

```

Speaking of documentation, this is something I found a while back:

`On Windows, you cannot connect with an underprivileged account and use become to elevate your rights. Become can only be used if your connection account is already an Administrator of the target host.`

The win\_updates documentation mentions this:

```auto
  become: true
  become_method: runas
  become_user: SYSTEM

```

which I just tried, resulting in the same error.

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [March 25, 2024, 8:16pm UTC](https://forum.ansible.com/t/access-denied-error-when-running-win-updates-module-on-windows-vsphere-hosts/4559/4 "2024-03-25T20:16:47Z")

</div>

Sorry, apparently this is a broader and known issue that @jborean has yet been unable to replicate to try and find a fix.

[win\_update failed since ansible 7.7.0 · Issue #593 · ansible-collections/ansible.windows (github.com)](https://github.com/ansible-collections/ansible.windows/issues/593)

[Issue on running ansible.windows.win\_updates module · Issue #540 · ansible-collections/ansible.windows (github.com)](https://github.com/ansible-collections/ansible.windows/issues/540)

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [March 25, 2024, 8:29pm UTC](https://forum.ansible.com/t/access-denied-error-when-running-win-updates-module-on-windows-vsphere-hosts/4559/5 "2024-03-25T20:29:16Z")

</div>

Looks like you might have some success if you use switch from the winrm connection plugin to the psrp plugin, but I’m sure Jordan would appreciate some feedback if you’re in a position to dig further into it. I’m wondering if there’s a Security Policy applied by GPO that might affect how privilege escalation impacts the winrm plugin vs the prsp one.

---

<div class="post-metadata">

**Author:** ![krustwell](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/krustwell/32/2676_2.png) [@krustwell](https://forum.ansible.com/u/krustwell)\
**Post date:** [March 25, 2024, 8:32pm UTC](https://forum.ansible.com/t/access-denied-error-when-running-win-updates-module-on-windows-vsphere-hosts/4559/6 "2024-03-25T20:32:21Z")

</div>

I’m going to try the psrp route and update the thread. And if I can provide any info to Jordan, I certainly will try.

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![krustwell](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/krustwell/32/2676_2.png) [@krustwell](https://forum.ansible.com/u/krustwell)\
**Post date:** [March 25, 2024, 8:51pm UTC](https://forum.ansible.com/t/access-denied-error-when-running-win-updates-module-on-windows-vsphere-hosts/4559/7 "2024-03-25T20:51:12Z")

</div>

Wow, i changed my host file:

```auto
#ansible_connection=winrm
ansible_connection=psrp

```

And it worked. Such a simple fix to a problem that’s been vexing me for several days.

Thank you again!

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [March 25, 2024, 9:30pm UTC](https://forum.ansible.com/t/access-denied-error-when-running-win-updates-module-on-windows-vsphere-hosts/4559/8 "2024-03-25T21:30:39Z")

</div>

If you have any more info on the host setup that you might think is relevant it would be great to post on one of those issues. I would really love to find the underlying problem but my hands are tied in that I cannot replicate and thus cannot see what the underlying problem is.

---

<div class="post-metadata">

**Author:** ![krustwell](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/krustwell/32/2676_2.png) [@krustwell](https://forum.ansible.com/u/krustwell)\
**Post date:** [April 1, 2024, 3:40pm UTC](https://forum.ansible.com/t/access-denied-error-when-running-win-updates-module-on-windows-vsphere-hosts/4559/9 "2024-04-01T15:40:47Z")

</div>

Just to muddy the waters a bit:

The issue I reported was happening when I ran the playbook from the command line on one of our Jenkins nodes. Changing the protocol from winrm to psrp in my inventory fixed that. I then put the job in our Jenkins UI, at which point it failed repeatedly saying pypsrp dependencies were missing. I changed the Jenkins job back to winrm and now THAT works.

I’m happy to supply any requested information, provided I have the time, know how, etc.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [May 1, 2024, 3:41pm UTC](https://forum.ansible.com/t/access-denied-error-when-running-win-updates-module-on-windows-vsphere-hosts/4559/10 "2024-05-01T15:41:28Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.