# Ansible on Windows w/o administrator privileges possible?

**URL:** <https://forum.ansible.com/t/ansible-on-windows-w-o-administrator-privileges-possible/22503>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [September 7, 2016, 9:19am UTC](https://forum.ansible.com/t/ansible-on-windows-w-o-administrator-privileges-possible/22503 "2016-09-07T09:19:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![alv2412](https://avatars.discourse-cdn.com/v4/letter/a/ce7236/32.png) [@alv2412](https://forum.ansible.com/u/alv2412)\
**Post date:** [September 7, 2016, 9:19am UTC](https://forum.ansible.com/t/ansible-on-windows-w-o-administrator-privileges-possible/22503/1 "2016-09-07T09:19:11Z")

</div>

Hello,

Is it possible to use a non-administrator user to run Ansible against Windows hosts and if yes, how?

I’ve used `invoke-command -computername localhost -credential ansible -scriptblock {$env:computername}` to test inside Powershell, which works fine only if the Ansible user is Administrator.

What did not help it:

- Add user to Windows Remote management group
- Add user to Windows Remote management and WinRMRemoteWMIUsers\_\_ group

Test target is this SRV2012R2 vagrant box: [https://atlas.hashicorp.com/mwrock/boxes/Windows2012R2](https://atlas.hashicorp.com/mwrock/boxes/Windows2012R2)

Regards  
Avaro Aleman

---

<div class="post-metadata">

**Author:** ![Matt\_Davis](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Matt\_Davis](https://forum.ansible.com/u/Matt_Davis)\
**Post date:** [September 8, 2016, 3:47pm UTC](https://forum.ansible.com/t/ansible-on-windows-w-o-administrator-privileges-possible/22503/2 "2016-09-08T15:47:45Z")

</div>

Yes, it’s absolutely possible. Usually the limiting factor on a default install is the WinRM listener ACL- you can see/alter this via:

winrm configSDDL default

and add the necessary users/groups (or add the existing Windows Remote Management group).

---

<div class="post-metadata">

**Author:** ![Matt\_Davis](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Matt\_Davis](https://forum.ansible.com/u/Matt_Davis)\
**Post date:** [September 8, 2016, 3:49pm UTC](https://forum.ansible.com/t/ansible-on-windows-w-o-administrator-privileges-possible/22503/3 "2016-09-08T15:49:33Z")

</div>

(typical cases only need the “read” and “execute” permission)

---

<div class="post-metadata">

**Author:** ![alv2412](https://avatars.discourse-cdn.com/v4/letter/a/ce7236/32.png) [@alv2412](https://forum.ansible.com/u/alv2412)\
**Post date:** [September 9, 2016, 9:59am UTC](https://forum.ansible.com/t/ansible-on-windows-w-o-administrator-privileges-possible/22503/4 "2016-09-09T09:59:41Z")

</div>

That did the trick, thanks!