# Ansible to Windows with SSH, become not working

**URL:** <https://forum.ansible.com/t/ansible-to-windows-with-ssh-become-not-working/7574>\
**Category:** Get Help\
**Tags:** windows, ssh, runas\
**Created:** [August 1, 2024, 9:26am UTC](https://forum.ansible.com/t/ansible-to-windows-with-ssh-become-not-working/7574 "2024-08-01T09:26:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tonk](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tonk/32/214_2.png) [@tonk](https://forum.ansible.com/u/tonk)\
**Post date:** [August 1, 2024, 9:26am UTC](https://forum.ansible.com/t/ansible-to-windows-with-ssh-become-not-working/7574/1 "2024-08-01T09:26:18Z")

</div>

Hello all,

I am trying to get this to work, with Ansible:

- Login to a Windows server with SSH (this works)
- Do all kind of Windows things there (that works)

But the above only works when I login as the `Administrator` user.  
But I want to do _priviledge escalation_ either from Administrator to another, mortal user, or the other way around.

```auto
---
- name: Test runas
  hosts: windows
  gather_facts: false

  tasks:
    - name: Create my_dir directory
      ansible.windows.win_file:
        path: 'c:\temp\my_dir'
        state: directory
      become: true
      become_flags: |
        logon_type=interactive
        logon_flags=with_profile
      become_user: tdactyl

```

This playbook works, when run as the Administrar, but the created directory is not owned by the `tdactyl` user.

I have tried this with Kerberos and WinRM and that works, this is also in the Ansible documentation. But the documentation doesn’t mention on how to escalate when using SSH.

Any good ideas?

Thanks,  
TonK

Small update:

- [Ansible Unable To Run win\_powershell with become: yes (Win32ErrorCode 1314) · Issue #77698 · ansible/ansible · GitHub](https://github.com/ansible/ansible/issues/77698#issuecomment-1115350195) seems to indicate that this is not possible

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [August 1, 2024, 7:37pm UTC](https://forum.ansible.com/t/ansible-to-windows-with-ssh-become-not-working/7574/2 "2024-08-01T19:37:34Z")

</div>

> [@tonk](#):
>
> This playbook works, when run as the Administrar, but the created directory is not owned by the `tdactyl` user.

Keep in mind that the default owner for new objects with admin users is going to be the Administrators SID. You can typically see who the owner is going to be when running `whomai /groups` and seeing the entry that has the `Group owner` attribute set.

Also keep in mind that the `runas` become is not designed to elevate from a non-admin to admin user. Doing that is not really a thing on Windows for non-interactive scenarios as there is no non-interactive way to talk with the UAC prompt. The become mechanism is designed for things like bypassing the credential delegation problem, running a task as another user, specifying custom credentials for outbound authentication.

---

<div class="post-metadata">

**Author:** ![tonk](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tonk/32/214_2.png) [@tonk](https://forum.ansible.com/u/tonk)\
**Post date:** [August 2, 2024, 7:16am UTC](https://forum.ansible.com/t/ansible-to-windows-with-ssh-become-not-working/7574/3 "2024-08-02T07:16:50Z")

</div>

Yes, I saw that in the GitHub issue.  
I’ll just use an Admin for now.

Thanks.