# how to start / stop windows services as unprivileged user via ansible?

**URL:** <https://forum.ansible.com/t/how-to-start-stop-windows-services-as-unprivileged-user-via-ansible/35452>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [July 2, 2021, 12:02pm UTC](https://forum.ansible.com/t/how-to-start-stop-windows-services-as-unprivileged-user-via-ansible/35452 "2021-07-02T12:02:47Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![0asp0](https://avatars.discourse-cdn.com/v4/letter/0/e68b1a/32.png) [@0asp0](https://forum.ansible.com/u/0asp0)\
**Post date:** [July 2, 2021, 12:02pm UTC](https://forum.ansible.com/t/how-to-start-stop-windows-services-as-unprivileged-user-via-ansible/35452/1 "2021-07-02T12:02:47Z")

</div>

Hi, I need to start / stop services as **unprivileged** user via ansible on a windows machine. So ansible will login as unprivileged user.

I tried both: the recommended version of win32-openssh linked in ansible documentation and WinRM. I would say I have the same issues on both.

When I connect via RDP i can start / stop services via net start / stop .

To allow the user to start / stop the service, I added following permissions like in the guide here: [https://stackoverflow.com/questions/4436558/start-stop-a-windows-service-from-a-non-administrator-user-account](https://stackoverflow.com/questions/4436558/start-stop-a-windows-service-from-a-non-administrator-user-account)

I also tried to give the same permissions as builtin administrators (BA), but no change.  
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;; **CCDCLCSWRPWPDTLOCRSDRCWDWO** ;;;S-1-5-21-881029431-239188376-3696334862-1013)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

When trying to sent net start/stop via ssh or winrm I get following error:

Systemfehler 5 aufgetreten.

Zugriff verweigert

When trying the same as administrator it works fine.

When using ansible with module win\_service I get following error:

\<192.168.3.xxx\> ESTABLISH SSH CONNECTION FOR USER: jboss-myEnv01  
\<192.168.3.xxx\> SSH: EXEC sshpass -d8 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o ‘User=“jboss-myEnv01”’ -o ConnectTimeout=10 -o ControlPath=/home/aschampe/.ansible/cp/e6487bf836 192.168.3.xxx ‘[chcp.com](http://chcp.com) 65001 \>nul 2\>&1 && PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=’  
\<192.168.3.xxx\> (1, ‘{“exception”:“Der Dienststeuerungs-Manager auf dem Computer . kann nicht ge\xc3\xb6ffnet werden. M\xc3\xb6glicherweise verf\xc3\xbcgen Sie nicht \xc3\xbcber die Berechtigung zum Ausf\xc3\xbchren dieses Vorgangs.\r\nIn Zeile:416 Zeichen:8\r\n+ $svc = Get-Service | Where-Object { $_.Name -eq $name -or $_.DisplayN …\r\n+ ~~~~~~~~~~~ \r\n + CategoryInfo : NotSpecified: (🙂 [Get-Service], InvalidOperationException\r\n + FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.PowerShell.Commands.GetServiceCommand\r\n\r\nScriptStackTrace:\r\nbei \u003cScriptBlock\u003e, \u003cKeine Datei\u003e: Zeile 416\r\n\r\nSystem.InvalidOperationException: Der Dienststeuerungs-Manager auf dem Computer . kann nicht ge\xc3\xb6ffnet werden. M\xc3\xb6glicherweise verf\xc3\xbcgen Sie nicht \xc3\xbcber die Berechtigung zum Ausf\xc3\xbchren dieses Vorgangs. —\u003e System.ComponentModel.Win32Exception: Zugriff verweigert\r\n — Ende der internen Ausnahmestapel\xc3\xbcberwachung —\r\n bei System.ServiceProcess.ServiceController.GetDataBaseHandleWithAccess(String machineName, Int32 serviceControlManaqerAccess)\r\n bei System.ServiceProcess.ServiceController.GetServicesOfType(String machineName, Int32 serviceType)\r\n bei System.ServiceProcess.ServiceController.GetServices()\r\n bei Microsoft.PowerShell.Commands.MultipleServiceCommandBase.get\_AllServices()\r\n bei Microsoft.PowerShell.Commands.MultipleServiceCommandBase.MatchingServicesByServiceName()\r\n bei Microsoft.PowerShell.Commands.MultipleServiceCommandBase.MatchingServices()\r\n bei Microsoft.PowerShell.Commands.GetServiceCommand.ProcessRecord()\r\n bei System.Management.Automation.CommandProcessor.ProcessRecord()”,“msg”:“Unhandled exception while executing module: Der Dienststeuerungs-Manager auf dem Computer . kann nicht ge\xc3\xb6ffnet werden. M\xc3\xb6glicherweise verf\xc3\xbcgen Sie nicht \xc3\xbcber die Berechtigung zum Ausf\xc3\xbchren dieses Vorgangs.”,“failed”:true}\r\n’, ‘#\< CLIXML\r\nSystem.Management.Automation.PSCustomObjectSystem.Object1Module werden f\xc3\xbcr erstmalige Verwendung vorbereitet.0-1-1Completed-1 ’)  
\<192.168.3.xxx\> Failed to connect to the host via ssh: #\< CLIXML  
System.Management.Automation.PSCustomObjectSystem.Object1Module werden für erstmalige Verwendung vorbereitet.0-1-1Completed-1

The full traceback is:  
Der Dienststeuerungs-Manager auf dem Computer . kann nicht geöffnet werden. Möglicherweise verfügen Sie nicht über die Berechtigung zum Ausführen dieses Vorgangs.  
In Zeile:416 Zeichen:8

- $svc = Get-Service | Where-Object { $_.Name -eq $name -or $_.DisplayN …
- 

```auto

```

- CategoryInfo : NotSpecified: (🙂 [Get-Service], InvalidOperationException
- FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.PowerShell.Commands.GetServiceCommand

ScriptStackTrace:  
bei , : Zeile 416

System.InvalidOperationException: Der Dienststeuerungs-Manager auf dem Computer . kann nicht geöffnet werden. Möglicherweise verfügen Sie nicht über die Berechtigung zum Ausführen dieses Vorgangs. —\> System.ComponentModel.Win32Exception: Zugriff verweigert  
— Ende der internen Ausnahmestapelüberwachung —  
bei System.ServiceProcess.ServiceController.GetDataBaseHandleWithAccess(String machineName, Int32 serviceControlManaqerAccess)  
bei System.ServiceProcess.ServiceController.GetServicesOfType(String machineName, Int32 serviceType)  
bei System.ServiceProcess.ServiceController.GetServices()  
bei Microsoft.PowerShell.Commands.MultipleServiceCommandBase.get\_AllServices()  
bei Microsoft.PowerShell.Commands.MultipleServiceCommandBase.MatchingServicesByServiceName()  
bei Microsoft.PowerShell.Commands.MultipleServiceCommandBase.MatchingServices()  
bei Microsoft.PowerShell.Commands.GetServiceCommand.ProcessRecord()  
bei System.Management.Automation.CommandProcessor.ProcessRecord()  
SSW-Win1 | FAILED! =\> {  
“changed”: false,  
“msg”: “Unhandled exception while executing module: Der Dienststeuerungs-Manager auf dem Computer . kann nicht geöffnet werden. Möglicherweise verfügen Sie nicht über die Berechtigung zum Ausführen dieses Vorgangs.”  
}

I also give this article a chance [https://support.microsoft.com/en-us/topic/block-remote-callers-who-are-not-local-administrators-from-starting-stopping-services-c5f77f8e-09e6-57e6-72d1-2c4423627a24](https://support.microsoft.com/en-us/topic/block-remote-callers-who-are-not-local-administrators-from-starting-stopping-services-c5f77f8e-09e6-57e6-72d1-2c4423627a24) and disabled the check systemwide. No effect.

When trying the same with an administrative account via ssh, it works fine.

Any ideas / hints are welcome.  
Thanks in advance, Andreas