# Changing Registry key owner in Ansible

**URL:** <https://forum.ansible.com/t/changing-registry-key-owner-in-ansible/30971>\
**Category:** Ansible Project\
**Created:** [August 7, 2019, 9:11am UTC](https://forum.ansible.com/t/changing-registry-key-owner-in-ansible/30971 "2019-08-07T09:11:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yuval\_Zaltz](https://avatars.discourse-cdn.com/v4/letter/y/e0b2c6/32.png) [@Yuval\_Zaltz](https://forum.ansible.com/u/Yuval_Zaltz)\
**Post date:** [August 7, 2019, 9:11am UTC](https://forum.ansible.com/t/changing-registry-key-owner-in-ansible/30971/1 "2019-08-07T09:11:58Z")

</div>

Is there a way in Ansible to change registry key ownership? win\_acl doesn’t cover it

I’m running this task

- name: Change key owner to machine admins  
win\_acl:  
path: HKCR:\CLSID{76A64158-CB41-11D1-8B02-00600806D9B6}  
user: “{{ inventory\_hostname\_short }}\Administrators”  
rights: FullControl  
type: allow  
inherit: ContainerInherit, ObjectInherit

and getting this error , as the owner

FAILED! =\> {  
“changed”: false,  
“msg”: “an exception occurred when adding the specified rule - Requested registry access is not allowed.”  
}

run as the owner didn’t work:

- name: Change key owner to machine admins  
win\_acl:  
path: HKCR:\CLSID{76A64158-CB41-11D1-8B02-00600806D9B6}  
user: “{{ inventory\_hostname\_short }}\Administrators”  
rights: FullControl  
type: allow  
inherit: ContainerInherit, ObjectInherit  
become: yes  
become\_user: TrustedInstaller  
become\_method: runas

---

<div class="post-metadata">

**Author:** ![Yuval\_Zaltz](https://avatars.discourse-cdn.com/v4/letter/y/e0b2c6/32.png) [@Yuval\_Zaltz](https://forum.ansible.com/u/Yuval_Zaltz)\
**Post date:** [August 7, 2019, 11:39am UTC](https://forum.ansible.com/t/changing-registry-key-owner-in-ansible/30971/2 "2019-08-07T11:39:48Z")

</div>

For now managed with [https://helgeklein.com/setacl](https://helgeklein.com/setacl) - SetACL but I’m interested to know if there is a Ansible solution

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [August 7, 2019, 8:27pm UTC](https://forum.ansible.com/t/changing-registry-key-owner-in-ansible/30971/3 "2019-08-07T20:27:14Z")

</div>

The win\_acl module just adds an ACE to the DACL of an object and doesn’t adjust the owner. Technically the win\_owner module can do that but that’s only designed for files/directories and not registry keys.

As for your become\_user: TrustedInstaller task, we currently can’t runas that user as it’s a bit more complicated than others. Unfortunately there isn’t an easy solution I have for you right now as they require a lot of manual PowerShell code. Maybe you can tell us why you need to adjust the permissions of this key?

Thanks

Jordan

---

<div class="post-metadata">

**Author:** ![Yuval\_Zaltz](https://avatars.discourse-cdn.com/v4/letter/y/e0b2c6/32.png) [@Yuval\_Zaltz](https://forum.ansible.com/u/Yuval_Zaltz)\
**Post date:** [August 9, 2019, 8:33am UTC](https://forum.ansible.com/t/changing-registry-key-owner-in-ansible/30971/4 "2019-08-09T08:33:22Z")

</div>

I Default permission for the local admin for the key is’t full and unless admins take ownership on the key

בתאריך יום ד׳, 7 באוג׳ 2019, 23:27, מאת Jordan Borean ‏\<[jborean93@gmail.com](mailto:jborean93@gmail.com)\>:

---

<div class="post-metadata">

**Author:** ![Yuval\_Zaltz](https://avatars.discourse-cdn.com/v4/letter/y/e0b2c6/32.png) [@Yuval\_Zaltz](https://forum.ansible.com/u/Yuval_Zaltz)\
**Post date:** [August 9, 2019, 12:22pm UTC](https://forum.ansible.com/t/changing-registry-key-owner-in-ansible/30971/5 "2019-08-09T12:22:59Z")

</div>

unless you take ownership on the key you can’t chnge the permission

בתאריך יום ו׳, 9 באוג׳ 2019, 11:33, מאת Yuval Zaltz ‏\<[yzaltz@gmail.com](mailto:yzaltz@gmail.com)\>: