# WinRM permissions **URL:** \ **Category:** Get Help\ **Tags:** winrm, windows\ **Created:** [April 7, 2025, 8:05pm UTC](https://forum.ansible.com/t/winrm-permissions/41583 "2025-04-07T20:05:31Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ajbrehm](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ajbrehm/32/8080_2.png) [@ajbrehm](https://forum.ansible.com/u/ajbrehm)\ **Post date:** [April 7, 2025, 8:05pm UTC](https://forum.ansible.com/t/winrm-permissions/41583/1 "2025-04-07T20:05:31Z")
Hi all, > **[Windows Remote Management — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/os_guide/windows_winrm.html)** says that by winrm configSDDL default one should give access to the account or group used by Ainsible to allow non-administrator access to WinRM. I understand “default” is really the default security descriptor for WinRM resources that do not have a security descriptor (at least that is what PowerShell says when I write into it). My questions are: Why does Ainsible not work with WinRM otherwise, given that theRemote Management Users group already has access to pretty much all WinRM resources and the Ainsible account is in it? What permissions are really missing (on what resource), so that setting the default permissions must be changed and why not change those specific permissions? Changing the default permissions seems a bit extreme. Any ideas? ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [April 8, 2025, 12:49am UTC](https://forum.ansible.com/t/winrm-permissions/41583/2 "2025-04-08T00:49:23Z")
> Why does Ainsible not work with WinRM otherwise, given that theRemote Management Users group already has access to pretty much all WinRM resources and the Ainsible account is in it? The `winrm` connection plugin uses the “default” winrm SD which only allows members of the `Administrators` group access (outside of `INTERACTIVE` which a network logon won’t use) ![image](https://us1.discourse-cdn.com/ansible/original/2X/e/e38cfdefc1159d35596db16f77576b2573785f15.png) The `Remote Management Users` is set on the PSRemoting WinRM endpoints which is what the `psrp` connection plugin connects to though. > What permissions are really missing (on what resource), so that setting the default permissions must be changed and why not change those specific permissions? I’m not aware of a way to set this for the resource the `winrm` connection plugin connects to. There could be something available to do so but I don’t know what it is. You should consider looking into the `psrp` connection plugin because that does more fine grained permissions set on the registered resource such as the `Remote Management Users` group. ---
**Author:** ![ajbrehm](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ajbrehm/32/8080_2.png) [@ajbrehm](https://forum.ansible.com/u/ajbrehm)\ **Post date:** [June 10, 2025, 1:16pm UTC](https://forum.ansible.com/t/winrm-permissions/41583/3 "2025-06-10T13:16:35Z")
Hello, back again after a few weeks. Isn’t modifying a template security descriptor very very dangerous? I understand this is the SD that gets applied to all resources that don’t have a (custom) SD. What exactly are we allowing here? ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [June 11, 2025, 2:16pm UTC](https://forum.ansible.com/t/winrm-permissions/41583/4 "2025-06-11T14:16:37Z")
Potentially, I do not know of any other way to edit the permissions used by the WinRS shell that the `winrm` connection plugin connects to. There may be something available and if you find it then I’ll love to document it and have it ready for the next person to ask. In the meantime the `psrp` connection plugin will use a different SD, it is stored on the individual session configuration and you can definitely change it just for that resource or create your own session configuration with your Ansible specific requirements.