# Windows Become Confusion

**URL:** <https://forum.ansible.com/t/windows-become-confusion/37216>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [October 13, 2022, 12:18am UTC](https://forum.ansible.com/t/windows-become-confusion/37216 "2022-10-13T00:18:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Husker79](https://avatars.discourse-cdn.com/v4/letter/h/7c8e57/32.png) [@Husker79](https://forum.ansible.com/u/Husker79)\
**Post date:** [October 13, 2022, 12:18am UTC](https://forum.ansible.com/t/windows-become-confusion/37216/1 "2022-10-13T00:18:48Z")

</div>

Good day,

I’m attempting to execute a PowerShell script on a Windows host to create a Windows Server Failover Cluster. Running the script on **node1** works without issue when logged in as a service account with appropriate AD permissions and using a PowerShell terminal ran as Administrator.

Executing the same script via Ansible (using the service account mentioned above) results in an error stating I do not have permissions to edit **node1’s** registry. Adding the “become” statements below get past this error, but then I receive an error that **node2** cannot be added to the cluster as I don’t have permissions to its registry.

```auto
- name: Execute configure_wsfc.ps1
  win_shell: .\configure_wsfc.ps1
  args:
    chdir: '{{ temp_dir }}'
  become: true
  become_method: runas
  become_user: '{{ service_account }}'

```

```auto

```

configure\_wsfc.ps1:

```auto
New-Cluster -Name $WSFCClusterName -Node ("node1", "node2") -AdministrativeAccessPoint ActiveDirectoryAndDNS -StaticAddress ("192.168.0.1", "192.168.0.2" -NoStorage

```

```auto

```

What am I missing?

Thank you.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [October 13, 2022, 3:28am UTC](https://forum.ansible.com/t/windows-become-confusion/37216/2 "2022-10-13T03:28:05Z")

</div>

To truly replicate the behaviour of running it interatively (or at least as close as you can get) you need to specify a password for become.

- win\_shell: …  
become: true  
become\_method: runas  
vars:  
ansible\_become\_user: ‘{{ ansible\_user }}’  
ansible\_become\_pass: ‘{{ ansible\_password }}’

This will create an “interactive” token that can delegate it’s credentials to downstream servers as needed. If you don’t specify a password then it will essentially do a “batch” logon without a password similar to running in a scheduled task but without saving the user’s credentials.

Thanks

Jordan

---

<div class="post-metadata">

**Author:** ![m.nelson](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@m.nelson](https://forum.ansible.com/u/m.nelson)\
**Post date:** [October 13, 2022, 8:54am UTC](https://forum.ansible.com/t/windows-become-confusion/37216/3 "2022-10-13T08:54:00Z")

</div>

Hi,

I think you playbook will work if you use CredSSP as the connection method:

[https://docs.ansible.com/ansible/latest/user\_guide/windows\_winrm.html](https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html)

CredSSP permits ansible to target other hosts from that it initially connected to.

Regards,

antuelle78

---

<div class="post-metadata">

**Author:** ![Husker79](https://avatars.discourse-cdn.com/v4/letter/h/7c8e57/32.png) [@Husker79](https://forum.ansible.com/u/Husker79)\
**Post date:** [October 13, 2022, 1:22pm UTC](https://forum.ansible.com/t/windows-become-confusion/37216/4 "2022-10-13T13:22:39Z")

</div>

Jordan,

Truly appreciate the reply. I guess I overlooked the below note in the documentation:

“…Use become with a password if the task needs to access network resources.”

I’m definitely not as experienced in Windows as Linux. WinRM and privilege escalation are as clear as mud.

Two quick Ansible on Windows questions, if I may.

- To run a PS script is it a better practice to use win\_command with powershell.exe -ExecutionPolicy Bypass -File script.ps1 or win\_shell as above?
- Why did failure of the PS script not fail the win\_shell task?  
Thank you and have a great day.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [October 17, 2022, 12:16am UTC](https://forum.ansible.com/t/windows-become-confusion/37216/5 "2022-10-17T00:16:28Z")

</div>

If you are running a script then I would say win\_shell is easier but neither are truly wrong… Unfortunately error handling in PowerShell is a bit of a mixed bag, by default it sets $ErrorActionPreference = ‘Continue’ which can cause some errors to be “ignored” or at least not part of the final error condition check. I would make sure that you have $ErrorActionPreference = ‘Stop’ in your script to ensure that an error actually stops your script and exits with a non-0 return code or at least throw an exception in the cases where you want a failure to occur.