# Failed to get token for NT AUTHORITY\\SYSTEM required for become as a service account or an account without a password **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [April 15, 2021, 2:15pm UTC](https://forum.ansible.com/t/failed-to-get-token-for-nt-authority-system-required-for-become-as-a-service-account-or-an-account-without-a-password/34992 "2021-04-15T14:15:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![vijay\_varma\_penumats](https://avatars.discourse-cdn.com/v4/letter/v/e480ec/32.png) [@vijay\_varma\_penumats](https://forum.ansible.com/u/vijay_varma_penumats)\ **Post date:** [April 15, 2021, 2:15pm UTC](https://forum.ansible.com/t/failed-to-get-token-for-nt-authority-system-required-for-become-as-a-service-account-or-an-account-without-a-password/34992/1 "2021-04-15T14:15:40Z")
We are trying to install patches from Ansible on Windows servers and it used to work fine well, but recently few changes happened from AD or GPO which is causing the below error while executing the Windows updates script from Ansible. “Failed to get token for NT AUTHORITY\SYSTEM required for become as a service account or an account without a password” —\> System.Exception: Failed to get token for NT AUTHORITY\SYSTEM required for become as a service account or an account without a password “msg”: "internal error: failed to become user ‘SYSTEM’: Exception calling "CreateProcessAsUser" with "9" argument(s): "Failed to get token for NT AUTHORITY\SYSTEM required for become as a service account or an account without a password" ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [April 15, 2021, 9:53pm UTC](https://forum.ansible.com/t/failed-to-get-token-for-nt-authority-system-required-for-become-as-a-service-account-or-an-account-without-a-password/34992/2 "2021-04-15T21:53:17Z")
The primary reason for not being able to get the SYSTEM token (required for passwordless become on Windows) is your connection user doesn’t have the SeDebugPrivilege. This should be assigned to Admins users by default but sometimes custom environment settings remove this privilege. You can use the win\_whoami module to check what privileges you account has, or even just ‘win\_command: whoami /priv’. ---
**Author:** ![vijay\_varma\_penumats](https://avatars.discourse-cdn.com/v4/letter/v/e480ec/32.png) [@vijay\_varma\_penumats](https://forum.ansible.com/u/vijay_varma_penumats)\ **Post date:** [April 16, 2021, 3:40pm UTC](https://forum.ansible.com/t/failed-to-get-token-for-nt-authority-system-required-for-become-as-a-service-account-or-an-account-without-a-password/34992/3 "2021-04-16T15:40:05Z")
Hi Thanks for the update and it is the cause of issue, but Security team requested to disable it to prevent Against Mimikatz Attacks. They are not willing to enable it, is there any work around to make it work while SeDebugPrivilage dsabled, we tried to become user and used runas method still same error. ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [April 19, 2021, 11:55am UTC](https://forum.ansible.com/t/failed-to-get-token-for-nt-authority-system-required-for-become-as-a-service-account-or-an-account-without-a-password/34992/4 "2021-04-19T11:55:04Z")
There isn’t unfortunately, your security team should hopefully be aware that this doesn’t prevent Mimikatz attacks just makes it slightly harder. Once you are an admin it is trivial to give yourself the privileges necessary for Mimikatz to work (psexec -i -s mimikatz.exe). As for Ansible there really is no other way without us doing those same things that malware would do. We opted to make our code simple and require the standard rights you typically get as an administrator. ---
**Author:** ![vijay\_varma\_penumats](https://avatars.discourse-cdn.com/v4/letter/v/e480ec/32.png) [@vijay\_varma\_penumats](https://forum.ansible.com/u/vijay_varma_penumats)\ **Post date:** [April 19, 2021, 3:39pm UTC](https://forum.ansible.com/t/failed-to-get-token-for-nt-authority-system-required-for-become-as-a-service-account-or-an-account-without-a-password/34992/5 "2021-04-19T15:39:42Z")
Thanks for update, just for my understanding, I am able to reboot servers and search updates while running my domain admin account as runas which has Administrative rights. While installing patches only it is giving the error, when it is logging as Administrator user it should run the tasks right why it need to get as an Administrator again? ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [April 19, 2021, 7:10pm UTC](https://forum.ansible.com/t/failed-to-get-token-for-nt-authority-system-required-for-become-as-a-service-account-or-an-account-without-a-password/34992/6 "2021-04-19T19:10:46Z")
Updates are a tricky one, they don’t allow you to access the internal API when come from a network logon which is why we use become to bypass that limitation. Luckily if you are using the win\_updates module there is an option use\_scheduled\_task [1] option you can set to not use become but a scheduled task to bypass that limitation as well. [1] [https://docs.ansible.com/ansible/latest/collections/ansible/windows/win\_updates\_module.html#parameter-use\_scheduled\_task](https://docs.ansible.com/ansible/latest/collections/ansible/windows/win_updates_module.html#parameter-use_scheduled_task)