# win\_command not exec admin mode

**URL:** <https://forum.ansible.com/t/win-command-not-exec-admin-mode/27385>\
**Category:** Ansible Developer\
**Created:** [April 26, 2018, 12:12pm UTC](https://forum.ansible.com/t/win-command-not-exec-admin-mode/27385 "2018-04-26T12:12:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aidewuado](https://avatars.discourse-cdn.com/v4/letter/a/ba9def/32.png) [@aidewuado](https://forum.ansible.com/u/aidewuado)\
**Post date:** [April 26, 2018, 12:12pm UTC](https://forum.ansible.com/t/win-command-not-exec-admin-mode/27385/1 "2018-04-26T12:12:26Z")

</div>

hello comunity, mi english is very bad, but my problem is the flowing:

one partner install ansible in you ecosystem and install SQL-Server 2014 in silent mode and not problem. I install my ecosytem with ansible but in the momment to exec the silent installation win\_command is exected by default in the window server and the bash twrow error to access. Any idea for what my partner is OK and my NO.

my playbook:

- name: Crea directorios para SQL server  
win\_file:  
path: “{{ item }}”  
state: directory  
with\_items:

- “{{ mssql\_sqldata\_dir }}”

- “{{ mssql\_data\_dir }}”

- “{{ mssql\_logs\_dir }}”

- “{{ mssql\_bkps\_dir }}”

- “{{ mssql\_temp\_dir }}”

- name: Copia Archivo configuracion SQL  
win\_template:  
src: ConfigurationFile-2014.ini  
dest: C:\_archivos\ConfigurationFile.ini

- name: mount SQL Server ISO  
win\_disk\_image:  
image\_path: C:\_archivos\en\_sql\_server\_2014\_developer\_edition\_with\_service\_pack\_1\_x64\_dvd\_6668542.iso  
state: present  
#when: not sqlservr\_info.stat.exists  
register: iso\_mount

- name: grant the ansible user the SeTcbPrivilege right  
win\_user\_right:  
name: SeTcbPrivilege  
users: ‘{{ansible\_user}}’  
action: add

- name: run SQL server setup.exe  
win\_command: ‘setup.exe /Q /ConfigurationFile={{ servers\_setup\_dir }}\ConfigurationFile.ini’  
args:  
chdir: “{{ iso\_mount.mount\_path }}”

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [April 26, 2018, 8:15pm UTC](https://forum.ansible.com/t/win-command-not-exec-admin-mode/27385/2 "2018-04-26T20:15:09Z")

</div>

Hi

When trying to install SQL Server it needs to interact with the DPAPI which is an API in Windows that interacts with various crypto elements. By default a command run over WinRM is unable to access the DPAPI for various security reasons in Windows and any application that tries to use like (like the SQL installer) will fail with an access is denied.

There are 2 main ways you can resolve this issue;

- Use become ([http://docs.ansible.com/ansible/latest/user\_guide/become.html#become-and-windows](http://docs.ansible.com/ansible/latest/user_guide/become.html#become-and-windows)) with the win\_command task to bypass that WinRM restriction run it like it would doing it manually on the host
- Use CredSSP authentication (ansible\_winrm\_transport: credssp) which allows any process to access DPAPI

I would highly recommend you use become in this case if you are on 2.5+, CredSSP is ok if you are on an older version of Ansible but it does send the username and password to the remote host which has other security implications. An example on how to use become for that task you would need to do;

`

- name: run SQL server setup.exe  
win\_command: setup.exe /Q /ConfigurationFile={{ servers\_setup\_dir}}\ConfigurationFile.ini  
args:  
chdir: “{{ iso\_mount.mount\_path }}”  
become: yes  
become\_method: runas  
become\_user: SYSTEM  
`

You can set the become\_user to a different user if you wish but this way no password is sent over the wire. One last thing, you task to add the user to the SeTcbPrivilege right, I would highly recommend you not do this if it isn’t needed.

Also on a side note, the Ansible Development channel is more geared towards dev work with Ansible, like modules and engine work. Questions/issues with using Ansible itself is probably better directed towards [https://groups.google.com/forum/#!forum/ansible-project](https://groups.google.com/forum/#!forum/ansible-project).

Thanks

Jordan

---

<div class="post-metadata">

**Author:** ![aidewuado](https://avatars.discourse-cdn.com/v4/letter/a/ba9def/32.png) [@aidewuado](https://forum.ansible.com/u/aidewuado)\
**Post date:** [April 27, 2018, 1:09pm UTC](https://forum.ansible.com/t/win-command-not-exec-admin-mode/27385/3 "2018-04-27T13:09:34Z")

</div>

thank it’s work!!!