# Access denied renaming windows domain joined server **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [July 4, 2018, 12:05am UTC](https://forum.ansible.com/t/access-denied-renaming-windows-domain-joined-server/27943 "2018-07-04T00:05:56Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Lee\_Drew](https://avatars.discourse-cdn.com/v4/letter/l/e0b2c6/32.png) [@Lee\_Drew](https://forum.ansible.com/u/Lee_Drew)\ **Post date:** [July 4, 2018, 12:05am UTC](https://forum.ansible.com/t/access-denied-renaming-windows-domain-joined-server/27943/1 "2018-07-04T00:05:56Z")
I’m trying to rename a domain joined server via the following play… - hosts: server tasks: - name: Rename server from server1 to server2 win\_shell: | $name = $env:COMPUTERNAME if ($name -ne “server1”) { Rename-Computer -NewName “server2” write-host “Server will need a restart…” } Ansible connects to the server via kerberos via a user account that has domain admin rights. However I receive an access denied message when running the play in verbose. Do I need to use become/run\_as even though I’m connecting via a domain admin account? ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [July 4, 2018, 12:38am UTC](https://forum.ansible.com/t/access-denied-renaming-windows-domain-joined-server/27943/2 "2018-07-04T00:38:20Z")
When connecting over WinRM, your credentials are by default not available to the remote process to use. Things that need to authenticate with a further server, like fileshares or domain actions, will fail as they have no credentials to use. While there are other options available you are best to use one of the following with Ansible - Use become on the task, this works by creating a new logon with explicit credentials, similar to what happens when you log on locally - Use CredSSP or Kerberos (with credential delegation enabled) and the remote process will have access to the credentials Also if you are on Ansible 2.6, there is now a win\_hostname module to do this instead of using win\_shell [https://docs.ansible.com/ansible/devel/modules/win\_hostname\_module.html](https://docs.ansible.com/ansible/devel/modules/win_hostname_module.html). Thanks Jordan ---
**Author:** ![Lee\_Drew](https://avatars.discourse-cdn.com/v4/letter/l/e0b2c6/32.png) [@Lee\_Drew](https://forum.ansible.com/u/Lee_Drew)\ **Post date:** [July 4, 2018, 2:09am UTC](https://forum.ansible.com/t/access-denied-renaming-windows-domain-joined-server/27943/3 "2018-07-04T02:09:47Z")
Awesome - thanks once again Jordan! I added the kerberos delegation. I’m running Ansible 2.5 so will look into upgrading 2.6 I know that the server will need a restart after running that remote PS command - what is the standard practice to then use win\_reboot based upon the result of a remote PS command? Do I just need to specify it in the play since I know that it is expected or is there a more programmatic way based upon a returned value for example? ansible\_reboot\_pending is currently set to false. Let me know if I should start a new thread for this… ---
**Author:** ![Lee\_Drew](https://avatars.discourse-cdn.com/v4/letter/l/e0b2c6/32.png) [@Lee\_Drew](https://forum.ansible.com/u/Lee_Drew)\ **Post date:** [July 4, 2018, 2:11am UTC](https://forum.ansible.com/t/access-denied-renaming-windows-domain-joined-server/27943/4 "2018-07-04T02:11:15Z")
E.G reboot based upon a value in stdout? ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [July 4, 2018, 3:37am UTC](https://forum.ansible.com/t/access-denied-renaming-windows-domain-joined-server/27943/5 "2018-07-04T03:37:26Z")
Best way if you are using win\_shell is to just base it on the stdout, the ansible\_reboot\_pending is a pretty useless fact that is gathered as part of setup and isn’t kept up to date during the task execution. In your case it would look something like this ` - win\_shell: | $name = $env:COMPUTERNAME if ($name -ne “server1”) { Rename-Computer -NewName “server2” Write-Host “reboot\_required” } register: hostname\_result - name: reboot if required win\_reboot: when: hostname\_result.stdout\_lines[0] == “reboot\_required” ` I haven’t tested this but basically it will output the reboot\_required text, the win\_reboot task will only run if the first line of the output contains that line. Thanks Jordan ---
**Author:** ![Lee\_Drew](https://avatars.discourse-cdn.com/v4/letter/l/e0b2c6/32.png) [@Lee\_Drew](https://forum.ansible.com/u/Lee_Drew)\ **Post date:** [July 4, 2018, 10:11am UTC](https://forum.ansible.com/t/access-denied-renaming-windows-domain-joined-server/27943/6 "2018-07-04T10:11:22Z")
Thanks Jordan - I had an element not found error when trying stdout\_lines[0]. I managed to get it working by using the following… when: ‘“reboot\_required” in hostname\_result.stdout’