# win\_group\_membership

**URL:** <https://forum.ansible.com/t/win-group-membership/27136>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [March 27, 2018, 10:37pm UTC](https://forum.ansible.com/t/win-group-membership/27136 "2018-03-27T22:37:30Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anil](https://avatars.discourse-cdn.com/v4/letter/a/da6949/32.png) [@Anil](https://forum.ansible.com/u/Anil)\
**Post date:** [March 27, 2018, 10:37pm UTC](https://forum.ansible.com/t/win-group-membership/27136/1 "2018-03-27T22:37:30Z")

</div>

Hello,

few questions on this module -

Context - we have Cloudform, that spins up windows machine and joins it to domain, now I need to add user to the local “Remote Desktop user” group on target windows machine. I hoping to achieve that using win\_group\_membership module, now my questions are -

- what type of protocol does it work with eg: winrm?
- Type of auth/permissions/privileges needed?  
simple example would be great

appreciate you help.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [March 28, 2018, 1:32am UTC](https://forum.ansible.com/t/win-group-membership/27136/2 "2018-03-28T01:32:34Z")

</div>

You can currently only use the winrm connection plugin with Ansible to talk to Windows hosts. WinRM allows you to connect using both domain and local accounts and usually you need administrative rights on that host to both connect and manipulate group membership. WinRM allows you to authenticate using various protocol such as;

- Basic
- Certificate (not the same as SSH keys)
- NTLM
- Kerberos
- CredSSP

More details can be found here [http://docs.ansible.com/ansible/latest/user\_guide/windows.html](http://docs.ansible.com/ansible/latest/user_guide/windows.html).

Thanks

Jordan

---

<div class="post-metadata">

**Author:** ![Anil](https://avatars.discourse-cdn.com/v4/letter/a/da6949/32.png) [@Anil](https://forum.ansible.com/u/Anil)\
**Post date:** [March 28, 2018, 3:58pm UTC](https://forum.ansible.com/t/win-group-membership/27136/3 "2018-03-28T15:58:37Z")

</div>

Thanks for elaborate information on ansible with windows.

Winrm is disabled by default. Not sure about the security constraints when we enable this service.

I will do research on it.

---

<div class="post-metadata">

**Author:** ![Anil](https://avatars.discourse-cdn.com/v4/letter/a/da6949/32.png) [@Anil](https://forum.ansible.com/u/Anil)\
**Post date:** [March 28, 2018, 11:04pm UTC](https://forum.ansible.com/t/win-group-membership/27136/4 "2018-03-28T23:04:58Z")

</div>

do you have any ideas on configuring winrm in the template(vmware)?

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [March 29, 2018, 8:12am UTC](https://forum.ansible.com/t/win-group-membership/27136/5 "2018-03-29T08:12:10Z")

</div>

vmware\_guest module allows you to run scripts in ‘runonce’ section, so you can run the configure for remoting script as part of this, and any other steps you need.

I use a playbook like the following to create vm from template. Before using you have to add a hostname to the ‘domainmember’ group and allocate it an ip address in your inventory, like this

`

# ansible inventory

[domainmember]  
testmachine01 ip=172.17.0.1

`

`

---

<div class="post-metadata">

**Author:** ![Anil](https://avatars.discourse-cdn.com/v4/letter/a/da6949/32.png) [@Anil](https://forum.ansible.com/u/Anil)\
**Post date:** [April 5, 2018, 12:04am UTC](https://forum.ansible.com/t/win-group-membership/27136/6 "2018-04-05T00:04:01Z")

</div>

thanks much for the example.

Quick question on ConfigureRemotingForAnsible.ps1 -ForceNewSSLCert -DisableBasicAuth, does this mean we can use any auth protocol as below expect Basic(not secure), correct? I am more inclined toward kerberos auth.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [April 5, 2018, 9:05pm UTC](https://forum.ansible.com/t/win-group-membership/27136/7 "2018-04-05T21:05:47Z")

</div>

With -DisableBasicAuth set then you can only use the defaults which NTLM and Kerberos. You can always check by running winrm get winrm/config/service and look at the values under the Auth section.

Thanks

Jordan