# Win\_robocopy getting "access denied" error

**URL:** <https://forum.ansible.com/t/win-robocopy-getting-access-denied-error/42658>\
**Category:** Get Help\
**Tags:** windows\
**Created:** [May 14, 2025, 9:48pm UTC](https://forum.ansible.com/t/win-robocopy-getting-access-denied-error/42658 "2025-05-14T21:48:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jyanga](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jyanga/32/8108_2.png) [@jyanga](https://forum.ansible.com/u/jyanga)\
**Post date:** [May 14, 2025, 9:48pm UTC](https://forum.ansible.com/t/win-robocopy-getting-access-denied-error/42658/1 "2025-05-14T21:48:01Z")

</div>

Hi.

I am trying to copy a directory structure from `\\server1\share1\folder1` to `c:\folder1` using `win_robocopy`. Here is a sample of my task.

```auto
 - name: "copy directory from share"
   win_robocopy:
     src: '\\server1\share1\folder1'
     dest: 'c:\folder1'
     flags: '/S /E /copy:DAT /mt /z'
   become: true
   become_user: "{{ ansible_user }}"

```

When I log into the machine as `ansible_user`, I do not need to provide the credentials to access `\\server1\share1\folder1` using File Explorer. However, when I run the playbook, i get an  
`Access Denied` error.

Help.

Thank you in advance.

ansible [core 2.16.14]

---

<div class="post-metadata">

**Author:** ![wayt](https://avatars.discourse-cdn.com/v4/letter/w/3be4f8/32.png) [@wayt](https://forum.ansible.com/u/wayt)\
**Post date:** [May 14, 2025, 10:04pm UTC](https://forum.ansible.com/t/win-robocopy-getting-access-denied-error/42658/2 "2025-05-14T22:04:36Z")

</div>

What authentication method are you using for WinRM? The method you select needs to support credential delegation to use UNC paths. This is not an Ansible problem but a side effect of WinRM and Windows. It can be replicated in a remote PSSession using powershell commandlets.

> **[Windows Remote Management — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/os_guide/windows_winrm.html#winrm-authentication)**

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [May 15, 2025, 3:54am UTC](https://forum.ansible.com/t/win-robocopy-getting-access-denied-error/42658/3 "2025-05-15T03:54:19Z")

</div>

You are using become but with no become password. Set the `ansible_become_password` variable to `{{ ansible_password }}` (or whatever var contains the password. Keep in mind this is a variable not a task option so needs to be set under the `vars` key.

---

<div class="post-metadata">

**Author:** ![it-pappa](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/it-pappa/32/7523_2.png) [@it-pappa](https://forum.ansible.com/u/it-pappa)\
**Post date:** [May 15, 2025, 7:06am UTC](https://forum.ansible.com/t/win-robocopy-getting-access-denied-error/42658/4 "2025-05-15T07:06:08Z")

</div>

Here is my solution to the same problem:  
The problem was something with that you need an extra login for windows hosts because how windows uses logons or whatever. Dont remember.

```auto
  become: true
  become_method: runas
  become_flags: logon_type=new_credentials logon_flags=netcredentials_only
  vars:
    ansible_become_user: '{{ vaulted_ansible_username }}'
    ansible_become_pass: '{{ vaulted_ansible_password }}'
  no_log: true

```

---

<div class="post-metadata">

**Author:** ![jyanga](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jyanga/32/8108_2.png) [@jyanga](https://forum.ansible.com/u/jyanga)\
**Post date:** [May 15, 2025, 4:25pm UTC](https://forum.ansible.com/t/win-robocopy-getting-access-denied-error/42658/5 "2025-05-15T16:25:46Z")

</div>

Thank you all for all the info. I ended using @it-pappa 's recommendation.