# Ansible Windows become\_user per task? **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [March 2, 2017, 6:32am UTC](https://forum.ansible.com/t/ansible-windows-become-user-per-task/23857 "2017-03-02T06:32:21Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![bob](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bob/32/9260_2.png) [@bob](https://forum.ansible.com/u/bob)\ **Post date:** [March 2, 2017, 6:32am UTC](https://forum.ansible.com/t/ansible-windows-become-user-per-task/23857/1 "2017-03-02T06:32:21Z")
Is there a way to “become\_user” per task on a Windows? - name: Install programs (win\_shell) win\_shell: “{{ item.dest }}/{{ item.program }} {{ item.arguments }}” register: cmd when: - window\_packages is defined with\_items: - “{{ window\_packages }}” become\_user: bob tags: win\_workstation2 Running the command with -vvvv shows I’m still WINRM as the Administrator \ ESTABLISH WINRM CONNECTION FOR USER: Administrator@CORP.LOCAL on PORT 5986 TO PC130.corp.local EXEC (via pipeline wrapper) Not sure how to check what user the task is running as but I don’t find the stuff I’d expect in AppData\Local ---
**Author:** ![Matt\_Davis](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Matt\_Davis](https://forum.ansible.com/u/Matt_Davis)\ **Post date:** [March 2, 2017, 11:36pm UTC](https://forum.ansible.com/t/ansible-windows-become-user-per-task/23857/2 "2017-03-02T23:36:22Z")
Yeah, docs forthcoming for this stuff, but you need to specify a couple more things to make it work (since the global \*nix defaults don’t make sense under Windows): First and foremost, you never actually said you want to “become”, just “who” you want to become- you need to add “become: yes” (this is not Windows-specific). Then you need to tell us which become method to use (become\_method: runas), as the default “sudo” isn’t implemented on Windows. You can set these at either the play or task level, as necessary, but “become: yes” is the key to actually making a task run as someone else- the rest is just “how”. See below for a sample. Also, there’s a bug right now that’s preventing become from working under NTLM and Kerberos auth (fails with “Access is denied”), so you can only use it with Basic, CredSSP, and Certificate auth (hoping to nail this one down in the next few days). Hope that helps… -Matt (ansible-dev) [mdavis@mdavis-t460p win2012r2-domain]$ cat become.yml - hosts: member1 gather\_facts: no become\_method: runas tasks: - name: as default user win\_shell: whoami - name: as administrator become: yes become\_user: administrator win\_shell: whoami (ansible-dev) [mdavis@mdavis-t460p win2012r2-domain]$ ansible-playbook -i hosts become.yml -vv -K No config file found; using defaults SUDO password: PLAYBOOK: become.yml \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 1 plays in become.yml PLAY [member1] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* META: ran handlers TASK [as default user] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* task path: /home/mdavis/vm/win2012r2-domain/become.yml:5 changed: [member1] =\> {“changed”: true, “cmd”: “whoami”, “delta”: “0:00:00.156427”, “end”: “2017-03-02 11:29:12.986398”, “rc”: 0, “start”: “2017-03-02 11:29:12.829970”, “stderr”: “”, “stderr\_lines”: , “stdout”: “ansible\testguy\r\n”, “stdout\_lines”: [“ansible\testguy”]} TASK [as administrator] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* task path: /home/mdavis/vm/win2012r2-domain/become.yml:8 changed: [member1] =\> {“changed”: true, “cmd”: “whoami”, “delta”: “0:00:00.187422”, “end”: “2017-03-02 11:29:13.876657”, “rc”: 0, “start”: “2017-03-02 11:29:13.689234”, “stderr”: “”, “stderr\_lines”: , “stdout”: “ansible\testguy\r\n”, “stdout\_lines”: [“ansible\testguy”]} META: ran handlers META: ran handlers PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* member1 : ok=2 changed=2 unreachable=0 failed=0 ---
**Author:** ![bob](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bob/32/9260_2.png) [@bob](https://forum.ansible.com/u/bob)\ **Post date:** [March 10, 2017, 7:35pm UTC](https://forum.ansible.com/t/ansible-windows-become-user-per-task/23857/3 "2017-03-10T19:35:04Z")
Is there a PR or repository I can follow so I know when the Kerberos auth stuff is available in devel branch? ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [March 15, 2017, 2:22pm UTC](https://forum.ansible.com/t/ansible-windows-become-user-per-task/23857/4 "2017-03-15T14:22:09Z")
This is the bug report so that’s probably the best place to look for now: [https://github.com/ansible/ansible/issues/22218](https://github.com/ansible/ansible/issues/22218) Jon