CLI "choco install rsat" works win_chocolatey install rsat fails

Discussing https://github.com/ansible/ansible/issues/39384, was told

  • The error indicates it is trying to install an msu (windows update) which doesn’t work over native WinRM
  • You need to use become on the win_chocolatey task to bypass the WinRM restriction, e.g.
    Which led me to https://github.com/ansible/ansible/issues/34214 which talks about blank passwords

Change my playbooks to look like this

https://github.com/ansible/ansible/issues/34214

become: yes
become_method: runas
become_user: LocalSystem
tags: win_chocolatey2

LocalSystem as the user does not work either.

Hey

The syntax I gave you is only for Ansible 2.5+ (you cannot become System on older versions) so if you are on an older version then this will fail. There are ways to get become to work for older versions of Ansible but they either require UAC to be disabled or the SeTcbPrivilege set to the ansible_user account. You can find more details here http://docs.ansible.com/ansible/latest/user_guide/become.html#administrative-rights but I highly recommend you upgrade to 2.5 to get it all working.

Unfortunately there is no way without become to install any .msu files in win_chocolatey so this is really your only option apart from manually running the choco command with something like psexec.

Thanks

Jordan

As a side note, you don’t have to do any of that registry changes for the System account, that is only for local or domain accounts that do not have a password, the builtin principals work as per normal without specifying the password.

From https://github.com/ansible/ansible/issues/39384 (you closed it) :slight_smile: I’m running from git devel branch:

$ ansible --version

ansible 2.6.0 (devel 33f358383a) last updated 2018/04/26 09:09:51 (GMT -500)
config file = None
configured module search path = [u’/Users/tanner/.ansible/plugins/modules’, u’/usr/share/ansible/plugins/modules’]
ansible python module location = /Users/tanner/projects/ansible.git/ansible/lib/ansible
executable location = /Users/tanner/projects/ansible.git/ansible/bin/ansible
python version = 2.7.10 (default, Feb 7 2017, 00:08:15) [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.34)]

Adding more information.

This Windows 10 system I am testing with is

Windows 10 Enterprises Evaluation
Windows License valid for 80 days
Build 16299.rs3_release_svc_escrow_im.180415-0955

Built with https://github.com/StefanScherer/packer-windows using the windows_10.json

Still having problems installing .msu’s with win_chocolatey.

chocolatey_msu:

  • rsat

  • name: Install msu (choco)
    win_chocolatey:
    name: “{{ item }}”
    state: “present”
    when:

  • chocolatey_msu is defined
    with_items:

  • “{{ chocolatey_msu }}”
    become: yes
    become_method: runas
    become_user: SYSTEM
    tags: win_chocolatey

TASK [win_chocolatey : Install msu (choco)] ************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: + FullyQualifiedErrorId : Win32Exception
failed: [surface02.corp] (item=rsat) => {“changed”: false, “item”: “rsat”, “msg”: “Exception calling "RunAsUser" with "7" argument(s): "LogonUser failed (The user name or password is incorrect, Win32ErrorCode 1326)"”}

The full traceback is:
Exception calling “RunAsUser” with “7” argument(s): “LogonUser failed (The user name or password is incorrect,
Win32ErrorCode 1326)”
At line:1083 char:9

  • $result = [Ansible.BecomeUtil]::RunAsUser($username, $passwor …
  • CategoryInfo : NotSpecified: (:slight_smile: , MethodInvocationException
  • FullyQualifiedErrorId : Win32Exception

failed: [surface02.corp] (item=rsat) => {
“changed”: false,
“item”: “rsat”,
“msg”: “Exception calling "RunAsUser" with "7" argument(s): "LogonUser failed (The user name or password is incorrect, Win32ErrorCode 1326)"”
}

$ ansible --version
ansible 2.6.0 (devel 1c4448666e) last updated 2018/05/04 12:29:36 (GMT -500)
config file = None
configured module search path = [u’/Users/tanner/.ansible/plugins/modules’, u’/usr/share/ansible/plugins/modules’]
ansible python module location = /Users/tanner/projects/ansible.git/ansible/lib/ansible
executable location = /Users/tanner/projects/ansible.git/ansible/bin/ansible
python version = 2.7.10 (default, Feb 7 2017, 00:08:15) [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.34)]

From http://docs.ansible.com/ansible/latest/user_guide/become.html a basic check of become and become_user fails.

  • win_shell: cmd.exe /c whoami && whoami /groups && whoami /priv
    become: yes
    become_user: System
    tags: win_chocolatey2

The full traceback is:
Exception calling “RunAsUser” with “7” argument(s): “LogonUser failed (The user name or password is incorrect,
Win32ErrorCode 1326)”
At line:1083 char:9

  • $result = [Ansible.BecomeUtil]::RunAsUser($username, $passwor …
  • CategoryInfo : NotSpecified: (:slight_smile: , MethodInvocationException
  • FullyQualifiedErrorId : Win32Exception

fatal: [surface02.corp]: FAILED! => {
“changed”: false,
“msg”: “Exception calling "RunAsUser" with "7" argument(s): "LogonUser failed (The user name or password is incorrect, Win32ErrorCode 1326)"”
}

I am attempting to re-open https://github.com/ansible/ansible/issues/39384#issuecomment-384756704

I think I see why it is failing, as mentioned in https://docs.ansible.com/ansible/latest/user_guide/become.html#directives

These can be set from play to task level, but are overridden by connection variables as they can be host specific.

This means directives like become, become_user, become_method work but if ansble_become, ansible_become_user, ansible_become_method are set as a host var then they will override the task directive.

What is happening here is that you would have ansible_become_user set somewhere in your inventory/host vars and that is overriding the task directive become_user: SYSTEM. This is now apparent to me as it is failing to run LogonUser which is a codepath that does not happen when using the System account, so another account is being passed in.

To test it out, you can write the task like this


- win_shell: cmd.exe /c whoami && whoami /groups && whoami /priv
  vars:
    ansible_become: yes
    ansible_become_method: runas
    ansible_become_user: SYSTEM

By settings the var explicitly on the task, you are overriding whatever may be set in your host vars.

Thanks

Jordan

Guess documentation is incorrect on command separators?

I cut-n-pasted from the documentation at http://docs.ansible.com/ansible/latest/user_guide/become.html

FAILED! => {“changed”: true, “cmd”: “cmd.exe /c whoami && whoami /groups && whoami /priv”, “delta”: “0:00:00.906452”, “end”: “2018-05-04 09:58:45.220693”, “msg”: “non-zero return code”, “rc”: 1, “start”: “2018-05-04 09:58:44.314241”, “stderr”: "At line:1 char:83\r\n+ … g = New-Object Text.UTF8Encoding $false; cmd.exe /c whoami && whoami …\r\n+ ~~\r\nThe token ‘&&’ is not a valid statement separator in this version.\r\nAt line:1 char:101\r\n+ … t.UTF8Encoding $false; cmd.exe /c whoami && whoami /groups && whoami …\r\n+

Cannot seem to win!

chocolatey_msu:

  • rsat

  • name: Install host specific msu (choco)
    win_chocolatey:
    name: “{{ item }}”
    state: “present”
    when:

  • host_chocolatey_msu is defined
    with_items:

  • “{{ host_chocolatey_msu }}”
    vars:
    ansible_become: yes
    ansible_become_method: runas
    ansible_become_user: SYSTEM

“stdout_lines”: [
“Chocolatey v0.10.10”,
“Installing the following packages:”,
“rsat”,
“By installing you accept licenses for the packages.”,
“[NuGet] Installing ‘RSAT 2.1’.”,
“[NuGet] Successfully installed ‘RSAT 2.1’.”,
“”,
“RSAT v2.1 [Approved]”,
“rsat package files install completed. Performing other installation steps.”,
“VERBOSE: Exporting function ‘Format-FileSize’.”,
“VERBOSE: Exporting function ‘Get-ChecksumValid’.”,
“VERBOSE: Exporting function ‘Get-ChocolateyUnzip’.”,
“VERBOSE: Exporting function ‘Get-ChocolateyWebFile’.”,
“VERBOSE: Exporting function ‘Get-EnvironmentVariable’.”,
“VERBOSE: Exporting function ‘Get-EnvironmentVariableNames’.”,
“VERBOSE: Exporting function ‘Get-FtpFile’.”,
“VERBOSE: Exporting function ‘Get-OSArchitectureWidth’.”,
“VERBOSE: Exporting function ‘Get-PackageParameters’.”,
“VERBOSE: Exporting function ‘Get-PackageParametersBuiltIn’.”,
“VERBOSE: Exporting function ‘Get-ToolsLocation’.”,
“VERBOSE: Exporting function ‘Get-UACEnabled’.”,
“VERBOSE: Exporting function ‘Get-UninstallRegistryKey’.”,
“VERBOSE: Exporting function ‘Get-VirusCheckValid’.”,
“VERBOSE: Exporting function ‘Get-WebFile’.”,
“VERBOSE: Exporting function ‘Get-WebFileName’.”,
“VERBOSE: Exporting function ‘Get-WebHeaders’.”,
“VERBOSE: Exporting function ‘Install-BinFile’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyDesktopLink’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyEnvironmentVariable’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyExplorerMenuItem’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyFileAssociation’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyInstallPackage’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyPackage’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyPath’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyPinnedTaskBarItem’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyPowershellCommand’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyShortcut’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyVsixPackage’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyZipPackage’.”,
“VERBOSE: Exporting function ‘Install-Vsix’.”,
“VERBOSE: Exporting function ‘Set-EnvironmentVariable’.”,
“VERBOSE: Exporting function ‘Set-PowerShellExitCode’.”,
“VERBOSE: Exporting function ‘Start-ChocolateyProcessAsAdmin’.”,
“VERBOSE: Exporting function ‘Test-ProcessAdminRights’.”,
“VERBOSE: Exporting function ‘Uninstall-BinFile’.”,
“VERBOSE: Exporting function ‘Uninstall-ChocolateyEnvironmentVariable’.”,
“VERBOSE: Exporting function ‘Uninstall-ChocolateyPackage’.”,
“VERBOSE: Exporting function ‘Uninstall-ChocolateyZipPackage’.”,
“VERBOSE: Exporting function ‘Update-SessionEnvironment’.”,
“VERBOSE: Exporting function ‘Write-ChocolateyFailure’.”,
“VERBOSE: Exporting function ‘Write-ChocolateySuccess’.”,
“VERBOSE: Exporting function ‘Write-FileUpdateLog’.”,
“VERBOSE: Exporting function ‘Write-FunctionCallLogMessage’.”,
“VERBOSE: Exporting alias ‘Get-ProcessorBits’.”,
“VERBOSE: Exporting alias ‘Get-OSBitness’.”,
“VERBOSE: Exporting alias ‘Get-InstallRegistryKey’.”,
“VERBOSE: Exporting alias ‘Generate-BinFile’.”,
“VERBOSE: Exporting alias ‘Add-BinFile’.”,
“VERBOSE: Exporting alias ‘Start-ChocolateyProcess’.”,
“VERBOSE: Exporting alias ‘Invoke-ChocolateyProcess’.”,
“VERBOSE: Exporting alias ‘Remove-BinFile’.”,
“VERBOSE: Exporting alias ‘refreshenv’.”,
“VERBOSE: Loading module from path ‘C:\ProgramData\chocolatey\extensions\chocolatey-core\chocolatey-core.psm1’.”,
“VERBOSE: Exporting function ‘Get-UninstallRegistryKey’.”,
“VERBOSE: Exporting function ‘Get-AppInstallLocation’.”,
“VERBOSE: Exporting function ‘Get-AvailableDriveLetter’.”,
“VERBOSE: Exporting function ‘Get-EffectiveProxy’.”,
“VERBOSE: Exporting function ‘Get-PackageCacheLocation’.”,
“VERBOSE: Exporting function ‘Get-PackageParameters’.”,
“VERBOSE: Exporting function ‘Get-WebContent’.”,
“VERBOSE: Exporting function ‘Register-Application’.”,
“VERBOSE: Importing function ‘Get-AppInstallLocation’.”,
“VERBOSE: Importing function ‘Get-AvailableDriveLetter’.”,
“VERBOSE: Importing function ‘Get-EffectiveProxy’.”,
“VERBOSE: Importing function ‘Get-PackageCacheLocation’.”,
“VERBOSE: Importing function ‘Get-PackageParameters’.”,
“VERBOSE: Importing function ‘Get-UninstallRegistryKey’.”,
“VERBOSE: Importing function ‘Get-WebContent’.”,
“VERBOSE: Importing function ‘Register-Application’.”,
“VERBOSE: Exporting function ‘Format-FileSize’.”,
“VERBOSE: Exporting function ‘Get-ChecksumValid’.”,
“VERBOSE: Exporting function ‘Get-ChocolateyUnzip’.”,
“VERBOSE: Exporting function ‘Get-ChocolateyWebFile’.”,
“VERBOSE: Exporting function ‘Get-EnvironmentVariable’.”,
“VERBOSE: Exporting function ‘Get-EnvironmentVariableNames’.”,
“VERBOSE: Exporting function ‘Get-FtpFile’.”,
“VERBOSE: Exporting function ‘Get-OSArchitectureWidth’.”,
“VERBOSE: Exporting function ‘Get-PackageParameters’.”,
“VERBOSE: Exporting function ‘Get-PackageParametersBuiltIn’.”,
“VERBOSE: Exporting function ‘Get-ToolsLocation’.”,
“VERBOSE: Exporting function ‘Get-UACEnabled’.”,
“VERBOSE: Exporting function ‘Get-UninstallRegistryKey’.”,
“VERBOSE: Exporting function ‘Get-VirusCheckValid’.”,
“VERBOSE: Exporting function ‘Get-WebFile’.”,
“VERBOSE: Exporting function ‘Get-WebFileName’.”,
“VERBOSE: Exporting function ‘Get-WebHeaders’.”,
“VERBOSE: Exporting function ‘Install-BinFile’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyDesktopLink’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyEnvironmentVariable’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyExplorerMenuItem’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyFileAssociation’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyInstallPackage’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyPackage’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyPath’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyPinnedTaskBarItem’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyPowershellCommand’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyShortcut’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyVsixPackage’.”,
“VERBOSE: Exporting function ‘Install-ChocolateyZipPackage’.”,
“VERBOSE: Exporting function ‘Install-Vsix’.”,
“VERBOSE: Exporting function ‘Set-EnvironmentVariable’.”,
“VERBOSE: Exporting function ‘Set-PowerShellExitCode’.”,
“VERBOSE: Exporting function ‘Start-ChocolateyProcessAsAdmin’.”,
“VERBOSE: Exporting function ‘Test-ProcessAdminRights’.”,
“VERBOSE: Exporting function ‘Uninstall-BinFile’.”,
“VERBOSE: Exporting function ‘Uninstall-ChocolateyEnvironmentVariable’.”,
“VERBOSE: Exporting function ‘Uninstall-ChocolateyPackage’.”,
“VERBOSE: Exporting function ‘Uninstall-ChocolateyZipPackage’.”,
“VERBOSE: Exporting function ‘Update-SessionEnvironment’.”,
“VERBOSE: Exporting function ‘Write-ChocolateyFailure’.”,
“VERBOSE: Exporting function ‘Write-ChocolateySuccess’.”,
“VERBOSE: Exporting function ‘Write-FileUpdateLog’.”,
“VERBOSE: Exporting function ‘Write-FunctionCallLogMessage’.”,
“VERBOSE: Exporting function ‘Get-AppInstallLocation’.”,
“VERBOSE: Exporting function ‘Get-AvailableDriveLetter’.”,
“VERBOSE: Exporting function ‘Get-EffectiveProxy’.”,
“VERBOSE: Exporting function ‘Get-PackageCacheLocation’.”,
“VERBOSE: Exporting function ‘Get-WebContent’.”,
“VERBOSE: Exporting function ‘Register-Application’.”,
“VERBOSE: Exporting alias ‘Get-ProcessorBits’.”,
“VERBOSE: Exporting alias ‘Get-OSBitness’.”,
“VERBOSE: Exporting alias ‘Get-InstallRegistryKey’.”,
“VERBOSE: Exporting alias ‘Generate-BinFile’.”,
“VERBOSE: Exporting alias ‘Add-BinFile’.”,
“VERBOSE: Exporting alias ‘Start-ChocolateyProcess’.”,
“VERBOSE: Exporting alias ‘Invoke-ChocolateyProcess’.”,
“VERBOSE: Exporting alias ‘Remove-BinFile’.”,
“VERBOSE: Exporting alias ‘refreshenv’.”,
“VERBOSE: Importing function ‘Format-FileSize’.”,
“VERBOSE: Importing function ‘Get-AppInstallLocation’.”,
“VERBOSE: Importing function ‘Get-AvailableDriveLetter’.”,
“VERBOSE: Importing function ‘Get-ChecksumValid’.”,
“VERBOSE: Importing function ‘Get-ChocolateyUnzip’.”,
“VERBOSE: Importing function ‘Get-ChocolateyWebFile’.”,
“VERBOSE: Importing function ‘Get-EffectiveProxy’.”,
“VERBOSE: Importing function ‘Get-EnvironmentVariable’.”,
“VERBOSE: Importing function ‘Get-EnvironmentVariableNames’.”,
“VERBOSE: Importing function ‘Get-FtpFile’.”,
“VERBOSE: Importing function ‘Get-OSArchitectureWidth’.”,
“VERBOSE: Importing function ‘Get-PackageCacheLocation’.”,
“VERBOSE: Importing function ‘Get-PackageParameters’.”,
“VERBOSE: Importing function ‘Get-PackageParametersBuiltIn’.”,
“VERBOSE: Importing function ‘Get-ToolsLocation’.”,
“VERBOSE: Importing function ‘Get-UACEnabled’.”,
“VERBOSE: Importing function ‘Get-UninstallRegistryKey’.”,
“VERBOSE: Importing function ‘Get-VirusCheckValid’.”,
“VERBOSE: Importing function ‘Get-WebContent’.”,
“VERBOSE: Importing function ‘Get-WebFile’.”,
“VERBOSE: Importing function ‘Get-WebFileName’.”,
“VERBOSE: Importing function ‘Get-WebHeaders’.”,
“VERBOSE: Importing function ‘Install-BinFile’.”,
“VERBOSE: Importing function ‘Install-ChocolateyDesktopLink’.”,
“VERBOSE: Importing function ‘Install-ChocolateyEnvironmentVariable’.”,
“VERBOSE: Importing function ‘Install-ChocolateyExplorerMenuItem’.”,
“VERBOSE: Importing function ‘Install-ChocolateyFileAssociation’.”,
“VERBOSE: Importing function ‘Install-ChocolateyInstallPackage’.”,
“VERBOSE: Importing function ‘Install-ChocolateyPackage’.”,
“VERBOSE: Importing function ‘Install-ChocolateyPath’.”,
“VERBOSE: Importing function ‘Install-ChocolateyPinnedTaskBarItem’.”,
“VERBOSE: Importing function ‘Install-ChocolateyPowershellCommand’.”,
“VERBOSE: Importing function ‘Install-ChocolateyShortcut’.”,
“VERBOSE: Importing function ‘Install-ChocolateyVsixPackage’.”,
“VERBOSE: Importing function ‘Install-ChocolateyZipPackage’.”,
“VERBOSE: Importing function ‘Install-Vsix’.”,
“VERBOSE: Importing function ‘Register-Application’.”,
“VERBOSE: Importing function ‘Set-EnvironmentVariable’.”,
“VERBOSE: Importing function ‘Set-PowerShellExitCode’.”,
“VERBOSE: Importing function ‘Start-ChocolateyProcessAsAdmin’.”,
“VERBOSE: Importing function ‘Test-ProcessAdminRights’.”,
“VERBOSE: Importing function ‘Uninstall-BinFile’.”,
“VERBOSE: Importing function ‘Uninstall-ChocolateyEnvironmentVariable’.”,
“VERBOSE: Importing function ‘Uninstall-ChocolateyPackage’.”,
“VERBOSE: Importing function ‘Uninstall-ChocolateyZipPackage’.”,
“VERBOSE: Importing function ‘Update-SessionEnvironment’.”,
“VERBOSE: Importing function ‘Write-ChocolateyFailure’.”,
“VERBOSE: Importing function ‘Write-ChocolateySuccess’.”,
“VERBOSE: Importing function ‘Write-FileUpdateLog’.”,
“VERBOSE: Importing function ‘Write-FunctionCallLogMessage’.”,
“VERBOSE: Importing alias ‘Add-BinFile’.”,
“VERBOSE: Importing alias ‘Generate-BinFile’.”,
“VERBOSE: Importing alias ‘Get-InstallRegistryKey’.”,
“VERBOSE: Importing alias ‘Get-OSBitness’.”,
“VERBOSE: Importing alias ‘Get-ProcessorBits’.”,
“VERBOSE: Importing alias ‘Invoke-ChocolateyProcess’.”,
“VERBOSE: Importing alias ‘refreshenv’.”,
“VERBOSE: Importing alias ‘Remove-BinFile’.”,
“VERBOSE: Importing alias ‘Start-ChocolateyProcess’.”,
“Windows 10 Detected”,
“VERBOSE: GET https://www.microsoft.com//download/confirmation.aspx?id=45520 with 0-byte payload”,
“VERBOSE: received 142462-byte response of content type text/html”,
“x64 Detected”,
“ERROR: Cannot process argument transformation on parameter ‘url64bit’. Cannot convert value to type System.String.”,
“The install of rsat was NOT successful.”,
“Error while running ‘C:\ProgramData\chocolatey\lib\RSAT\tools\chocolateyinstall.ps1’.”,
" See log for details.“,
“”,
“Chocolatey installed 0/1 packages. 1 packages failed.”,
" See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log).”,
“”,
“Failures”,
" - rsat (exited -1) - Error while running ‘C:\ProgramData\chocolatey\lib\RSAT\tools\chocolateyinstall.ps1’.“,
" See log for details.”
]
}

Yep, looks like we should update the docs to be correct, you can just do - win_shell: whoami to test it out.

No idea on that, looks like an issue in the install script for the rsat package. You can try to just become an existing user and not SYSTEM account like so

  • win_chocolatey:
    name: rsat
    state: present
    vars:
    ansible_become: yes
    ansible_become_method; runas
    ansible_become_user: ‘{{ ansible_user }}’
    ansible_become_pass: ‘{{ ansible_password }}’

I don’t have a Windows 10 box to test out but both this and becoming the System account worked fine on a Server 2016 machine for me.

Thanks

Jordan

Yep looking at the comments on the chocolatey package, Windows 10 seems to be broken https://chocolatey.org/packages/RSAT, you need to specify the version to get working but this is an issue outside of Ansible and win_chocolatey