# win\_acl and remote fileshares **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [April 3, 2020, 6:35pm UTC](https://forum.ansible.com/t/win-acl-and-remote-fileshares/32600 "2020-04-03T18:35:26Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![kzersatz](https://avatars.discourse-cdn.com/v4/letter/k/7bcc69/32.png) [@kzersatz](https://forum.ansible.com/u/kzersatz)\ **Post date:** [April 3, 2020, 6:35pm UTC](https://forum.ansible.com/t/win-acl-and-remote-fileshares/32600/1 "2020-04-03T18:35:26Z")
win\_acl and remote fileshares [https://docs.ansible.com/ansible/latest/modules/win\_acl\_module.html#win-acl-module](https://docs.ansible.com/ansible/latest/modules/win_acl_module.html#win-acl-module) Using the WIN\_ACL module, is it possible to manage file system permissions on a remote UNC path? Making the assumption that it is, so long as your user has permissions to do that operation I’m having consistent issues with Access is denied errors while trying to perform the following. ` prd\_svm\_fix: ‘\{{prd\_vserver}}.domain.net’ prd\_shr\_path: ‘{{prd\_svm\_fix}}{{vol\_junction}}{{obj\_name}}’ ##PERMISSIONS NONSENSE - name: Define RW permissions on new share. win\_acl: path: “{{ prd\_shr\_path }}” rights: Modify type: allow user: ‘DOMAIN{{ h\_dl\_prefix }}{{ u\_name }}{{ suffix\_RW }}’ inherit: containerinherit, objectinherit become: yes become\_method: runas become\_user: “[SA\_ANSIBLE@DOMAIN.NET](mailto:SA_ANSIBLE@DOMAIN.NET)” ` I’m made the attempt to not “Become” the service account listed, or do it natively through the user I’m connecting to my windows host as, but I’m having a hell of a time finding out precisely where I’m being waived off with this error. ` The full traceback is: Access is denied At line:106 char:11 - If (-Not (Test-Path -LiteralPath $path)) { - ```auto ``` - CategoryInfo : PermissionDenied: (\NAS.DOMAIN.net\Apps\toast:String) [Test-Path], UnauthorizedAccessException - FullyQualifiedErrorId : ItemExistsUnauthorizedAccessError,Microsoft.PowerShell.Commands.TestPathCommand ScriptStackTrace: at , : line 106 System.UnauthorizedAccessException: Access is denied —\> System.ComponentModel.Win32Exception: Access is denied — End of inner exception stack trace — at Microsoft.PowerShell.Commands.FileSystemProvider.ItemExists(String path, ErrorRecord& error) fatal: [[system.DOMAIN.net](http://system.DOMAIN.net)]: FAILED! =\> { “changed”: false, “msg”: “Unhandled exception while executing module: Access is denied” ` the UNC path I’m trying to change is not a windows file server, but instead a NetApp hosting the shares, this step is imediately after the vol/share is create and the ACL’s are flapping in the breeze wide open “Everyone: Full Control” so I don’t imagine it a filesystem “access is denied” issue. Any help/thoughts would be appreciated. Thanks! Jess ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [April 3, 2020, 6:39pm UTC](https://forum.ansible.com/t/win-acl-and-remote-fileshares/32600/2 "2020-04-03T18:39:36Z")
This is because of the double hop problem, without the users credentials the WinRM service cannot authenticate to those fileshares as that user so it appears to be an anonymous user which does not have access. The only way around this is to use become on the task or connect with an authentication option that support credential delegation like CredSSP or Kerberos with delegation enabled. ---
**Author:** ![kzersatz](https://avatars.discourse-cdn.com/v4/letter/k/7bcc69/32.png) [@kzersatz](https://forum.ansible.com/u/kzersatz)\ **Post date:** [April 3, 2020, 6:51pm UTC](https://forum.ansible.com/t/win-acl-and-remote-fileshares/32600/3 "2020-04-03T18:51:02Z")
Hey Jordan, How’s that different than what I’m doing here? ` become: yes become\_method: runas become\_user: “[SA\_ANSIBLE@DOMAIN.NET](mailto:SA_ANSIBLE@DOMAIN.NET)” ` Should I be using a different method? ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [April 3, 2020, 8:19pm UTC](https://forum.ansible.com/t/win-acl-and-remote-fileshares/32600/4 "2020-04-03T20:19:44Z")
I had trouble writing to files on a NetApp device via a windows host over winrm. In the end it transpired the netapp device was not actually a ‘domain peer’ - it wasn’t taking part in the domain and was just set up to allow ‘Everyone’ access to a share. That was fixed by upgrading to a newer NetApp device and I believe getting the netapp setup properly to take part in the domain. I don’t recall having to set acl on the files on the NetApp though, so maybe I had a different issue. Hope this helps, Jon ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [April 3, 2020, 8:52pm UTC](https://forum.ansible.com/t/win-acl-and-remote-fileshares/32600/5 "2020-04-03T20:52:15Z")
Sorry I misread what you said and thought you meant you didn’t think become mattered here but I see your problem. You’ve set the become vars as a module option to win\_acl, the directives should be on the same indentation as win\_acl itself. Unfortunately not all Windows modules currently validate that the options you’ve specified are actually supported, they are just silently ignored but hopefully over time more of them use the newer framework that does do that validation. In short your task should look like ` `- name: Define RW permissions on new share.` `win\_acl:` `path: “{{ prd\_shr\_path }}”` `rights: Modify` `type: allow` `user: ‘DOMAIN{{ h\_dl\_prefix }}{{ u\_name }}{{ suffix\_RW }}’` `inherit: containerinherit, objectinherit` `become: yes` `become\_method: runas` `vars:` `ansible\_become\_user: ‘{{ ansible\_user }}’` `ansible\_become\_pass: ‘{{ ansible\_password }}’` ` I’ve made a slight tweak to specify the user and password in the vars section. My reasons for this are - You need to specify the password or else you will have the same problem as WinRM where you become the user but with no password available, there is no task directive for ‘become\_pass’ and it needs to be set in a variable - Setting a var has a higher precedence than a task directive, so if you’ve set ‘become\_user: some user’ on your task but have set ‘ansible\_become\_user: other user’ in your host/group vars for that host, ‘other user’ is used. Setting it on the vars section of a task is pretty high up there on variable precedence with only a few things being higher (vars specified by -e is one of them) - I’ve also said to just become the connection user using the existing connection variables. This makes things host agnostic and just ensures that the process runs as the same connection user but has it’s credentials available for delegation ---
**Author:** ![kzersatz](https://avatars.discourse-cdn.com/v4/letter/k/7bcc69/32.png) [@kzersatz](https://forum.ansible.com/u/kzersatz)\ **Post date:** [April 6, 2020, 1:59pm UTC](https://forum.ansible.com/t/win-acl-and-remote-fileshares/32600/6 "2020-04-06T13:59:12Z")
Hi again Jordan, Those solutions absolutely did work for me, and have solved an issue elsewhere i was having as well, so thanks again. I do have a question about the module further. Namely, how the heck do I force this to assign domain groups? ` fatal: [[HOST.DOMAIN.net](http://HOST.DOMAIN.net)]: FAILED! =\> { “changed”: false, “msg”: “account\_name [GDHFStoastRW@DOMAIN.NET](mailto:GDHFStoastRW@DOMAIN.NET) is not a valid account, cannot get SID: Exception calling "Translate" with "1" argument(s): "Some or all identity references could not be translated."” } ` I know the groups exists, it was created in the play right before it, both models, domain\group and group@domain dont translate. ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [April 7, 2020, 3:49am UTC](https://forum.ansible.com/t/win-acl-and-remote-fileshares/32600/7 "2020-04-07T03:49:09Z")
Is the host actually joined to the domain the groups reside in, if you have multiple domain controllers it may not have replicated to whatever that host is talking to when finding the groups. ---
**Author:** ![kzersatz](https://avatars.discourse-cdn.com/v4/letter/k/7bcc69/32.png) [@kzersatz](https://forum.ansible.com/u/kzersatz)\ **Post date:** [April 7, 2020, 11:47am UTC](https://forum.ansible.com/t/win-acl-and-remote-fileshares/32600/8 "2020-04-07T11:47:17Z")
The filer/svm is a member of the domain. Domain groups had replicated (these groups are my test guys and have existed for weeks actually) The filer is not a member of the groups, that’d be a bit backwards versus what we’re trying to accomplish. ---
**Author:** ![kzersatz](https://avatars.discourse-cdn.com/v4/letter/k/7bcc69/32.png) [@kzersatz](https://forum.ansible.com/u/kzersatz)\ **Post date:** [April 7, 2020, 4:20pm UTC](https://forum.ansible.com/t/win-acl-and-remote-fileshares/32600/9 "2020-04-07T16:20:46Z")
Current permissions on file path ![](https://us1.discourse-cdn.com/ansible/original/2X/b/b296c872c3b15dcfdc887ce46ffdc78576792d6d.png) I’ve got 1500+ volumes off of this current filer that are all using NTFS permissions from this same domain as well without issue. I can assign them through set-acl through powershell just using a different path as the ACL fomatter through get-acl and assigning it as a variable without any fits. ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [April 8, 2020, 12:10am UTC](https://forum.ansible.com/t/win-acl-and-remote-fileshares/32600/10 "2020-04-08T00:10:55Z")
There’s not much more I can really say, Windows ACLs are based on SIDs so it needs to be able to translate a human readable name to the actual SID. If the module is complaining that it’s unable to to translate an identity that’s just what Windows is returning as it’s unable to translate the name to an actual SID. You shouldn’t need become or credential delegation enabled for this as the host will talk to the DC to translate the names under it’s own account. The only thing I would suggest is to try translating it yourself through a win\_shell task and see if it errors out ` - win\_shell: | $account = [System.Security.Principal.NTAccount]‘group@REALM.COM’ $account.Translate([System.Security.Principal.SecurityIdentifier]) ` If that works then I’m not sure why the win\_acl task is failing, you could try the Netlogon form ‘DOMAIN\group’ but the UPN should work just fine here. If the win\_shell task fails then there’s a problem with your host setup. Thanks Jordan