# Win\_acl permission inheritance child objects

**URL:** <https://forum.ansible.com/t/win-acl-permission-inheritance-child-objects/5627>\
**Category:** Get Help\
**Tags:** windows\
**Created:** [May 8, 2024, 4:35pm UTC](https://forum.ansible.com/t/win-acl-permission-inheritance-child-objects/5627 "2024-05-08T16:35:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![njoylif](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/njoylif/32/3353_2.png) [@njoylif](https://forum.ansible.com/u/njoylif)\
**Post date:** [May 8, 2024, 4:35pm UTC](https://forum.ansible.com/t/win-acl-permission-inheritance-child-objects/5627/1 "2024-05-08T16:35:09Z")

</div>

I’m noobie for Ansible…tiafyh  
I have windows web servers, I’m trying to add a user permissions to c:\inetpub\logs\logfiles\w3svc\* folders and child objects. I’ve researched inheritance, propagation, used win\_acl, win\_acl\_inheritance and various methods.

here is most recent example:  
I can’t figure out how to set this at c:\inetpub\logs\LogFiles level and propagate down.

## here’s Ansible playbook:

- name: Enable IIS on DD agent config  
hosts: IIS  
tasks:

HERE’s OUTPUT:  
PLAY [Enable IIS on DD agent config] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [xxxxxx]

TASK [Extract short hostname] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [xxxxxx]

TASK [Disable inherited ACE’s] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [xxxxxx]

TASK [Query ACL4] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
changed: [xxxxxx]

TASK [debug] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [xxxxxx] =\> {  
“GetACL4.stdout\_lines”: [  
“xxxxxx\ddagentuser Allow FullControl”,  
“NT SERVICE\WMSVC Allow ReadAndExecute, Synchronize”,  
“NT SERVICE\TrustedInstaller Allow FullControl”,  
“NT SERVICE\TrustedInstaller Allow 268435456”,  
“NT AUTHORITY\SYSTEM Allow FullControl”,  
“NT AUTHORITY\SYSTEM Allow 268435456”,  
“BUILTIN\Administrators Allow FullControl”,  
“BUILTIN\Administrators Allow 268435456”,  
“BUILTIN\Users Allow ReadAndExecute, Synchronize”,  
“BUILTIN\Users Allow -1610612736”,  
“CREATOR OWNER Allow 268435456”  
]  
}

TASK [add Modify rights to ddagentuser] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [xxxxxx]

TASK [Query ACL41] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
changed: [xxxxxx]

TASK [debug] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [xxxxxx] =\> {  
“GetACL41.stdout\_lines”: [  
“xxxxxx\ddagentuser Allow FullControl”,  
“NT SERVICE\WMSVC Allow ReadAndExecute, Synchronize”,  
“NT SERVICE\TrustedInstaller Allow FullControl”,  
“NT SERVICE\TrustedInstaller Allow 268435456”,  
“NT AUTHORITY\SYSTEM Allow FullControl”,  
“NT AUTHORITY\SYSTEM Allow 268435456”,  
“BUILTIN\Administrators Allow FullControl”,  
“BUILTIN\Administrators Allow 268435456”,  
“BUILTIN\Users Allow ReadAndExecute, Synchronize”,  
“BUILTIN\Users Allow -1610612736”,  
“CREATOR OWNER Allow 268435456”  
]  
}

TASK [Query SubFolder] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
changed: [xxxxxx]

TASK [debug] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [xxxxxx] =\> {  
“GetACL42.stdout\_lines”: [  
“NT AUTHORITY\SYSTEM Allow FullControl”,  
“BUILTIN\Administrators Allow FullControl”  
]  
}

---

<div class="post-metadata">

**Author:** ![mikemorency](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mikemorency/32/2672_2.png) [@mikemorency](https://forum.ansible.com/u/mikemorency)\
**Post date:** [May 9, 2024, 12:52pm UTC](https://forum.ansible.com/t/win-acl-permission-inheritance-child-objects/5627/2 "2024-05-09T12:52:43Z")

</div>

I think your playbook looks fine and the issue is with IIS controlling the permissions of child items. See this stack overflow issue: [logging - IIS log folder permissions not being inherited - Super User](https://superuser.com/questions/625975/iis-log-folder-permissions-not-being-inherited)

Have you tried your playbook on another set of directories? That would be a good sanity check.

Also, if you gathered facts on this host (in your playbook, you have) then you can use the builtin variable `ansible_hostname` to get the host name without the domain. I think thats what your doing when you set ansible\_short\_hostname

---

<div class="post-metadata">

**Author:** ![njoylif](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/njoylif/32/3353_2.png) [@njoylif](https://forum.ansible.com/u/njoylif)\
**Post date:** [May 9, 2024, 1:19pm UTC](https://forum.ansible.com/t/win-acl-permission-inheritance-child-objects/5627/3 "2024-05-09T13:19:35Z")

</div>

Thanks for your suggestions. I’ll test and reply back asap.

Larry Rice

---

<div class="post-metadata">

**Author:** ![njoylif](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/njoylif/32/3353_2.png) [@njoylif](https://forum.ansible.com/u/njoylif)\
**Post date:** [May 9, 2024, 2:21pm UTC](https://forum.ansible.com/t/win-acl-permission-inheritance-child-objects/5627/4 "2024-05-09T14:21:12Z")

</div>

you are correct @mikemorency, it worked when trying on some newly generated file structures.

so the workaround for IIS folder structure is:

```
  ansible.windows.win_powershell:
    script: |
        $l = Get-ChildItem -Path C:\inetpub\logs\LogFiles -Recurse -Directory -Force -ErrorAction SilentlyContinue | Select-Object FullName
        $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("xxxxxxxxx","ReadAndExecute","3","0","Allow") #FullControl

        foreach ($d in $l) {
            $ACL = Get-Acl -Path $d.FullName
            $ACL.SetAccessRule($AccessRule)
            $ACL | Set-Acl -Path $d.FullName
            }

```

thanks for taking time to comment!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [June 8, 2024, 2:22pm UTC](https://forum.ansible.com/t/win-acl-permission-inheritance-child-objects/5627/5 "2024-06-08T14:22:04Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.