Repository: ansible/ansible
Pull request: windows become - info about blank passwords
##### SUMMARY
Add info to the become docs for how to become a Windows account that does not have a password.

Fixes https://github.com/ansible/ansible/issues/34214

##### ISSUE TYPE
 - Docs Pull Request

##### COMPONENT NAME
windows become

##### ANSIBLE VERSION
```
2.5
```

Problem statement:
Windows become fails for passwordless users
##### ISSUE TYPE
 - Bug Report
 - Feature Idea

##### COMPONENT NAME
windows

##### ANSIBLE VERSION
v2.5

##### SUMMARY
Not sure whether this is a bug report or a feature request. At least it is a known issue ;-)

Currently `become` on Windows does not work for passwordless users (or locked users). It would be nice if we could run Powershell scripts for passwordless users as well. The limitation is in **RunAsUser**.

Maybe there is a pure-powershell way of elevating privileges that could enable running scripts for passwordless users, or users of which you don't know the password. (Like sudo basically)

```
The full traceback is:
Exception calling "RunAsUser" with "5" argument(s): "LogonUser failed (Deze gebruiker kan niet worden aangemeld vanwege accountbeperkingen. Bijvoorbeeld: blanco wachtwoorden zijn niet toegestaan, aanmeldingstijden zijn beperkt of er is een beleidsbeperking van kracht, Win32ErrorCode 1327)"
At line:983 char:9
+         $result = [Ansible.BecomeUtil]::RunAsUser($username, $passwor ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : Win32Exception
 

fatal: [computer91]: FAILED! => {
    "changed": false, 
    "msg": "Exception calling \"RunAsUser\" with \"5\" argument(s): \"LogonUser failed (Deze gebruiker kan niet worden aangemeld vanwege accountbeperkingen. Bijvoorbeeld: blanco wachtwoorden zijn niet toegestaan, aanmeldingstijden zijn beperkt of er is een beleidsbeperking van kracht, Win32ErrorCode 1327)\""
}
```

Hints from issue discussion:
Files identified in the description:
* [test/integration/targets/win_become/aliases](https://github.com/ansible/ansible/blob/devel/test/integration/targets/win_become/aliases)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
So I tried using the suggestion at https://github.com/ansible/ansible/issues/16202#issuecomment-225307500 but couldn't get it to work. An out-of-the-box solution would be preferred.

```yaml
    become: yes
    become_user: test
    become_password: null
```
Files identified in the description:
* [lib/ansible/modules/windows/__init__.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/__init__.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
cc @jborean93 @jhawkesworth
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
Just so I remember the English translation when I look into this further, `LogonUser` is failing with the error

`LogonUser failed (Account restrictions are preventing this user from signing in. For example: blank passwords aren't allowed, sign-in times are limited, or a policy restriction has been enforced, Win32ErrorCode 1327)`
After looking into it, this isn't an issue with the code but rather a restriction with Windows and the local security policies that are set. You need to disable the [Accounts: Limit local account use of blank passwords to console logon only](https://technet.microsoft.com/en-us/library/jj852174%28v=ws.11%29.aspx?f=255&MSPPError=-2147217396) policy as it restricts passwordless authentication to only work on a local console session. This results in the 1327 Win32 error code when trying it in sessions like RDP or WinRM. This is a security feature and should only be set if really required, in most cases it is best to actually have a password.

To disable this policy you can run

```
- win_regedit:
    path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa
    name: LimitBlankPasswordUse
    data: 0
    type: dword
    state: present
```

The computer does not need to be restarted after setting this policy. I know your scenario isn't in a domain environment so this doesn't affect you but for others reading this, you may need to set it under a GPO policy to override the domain defaults.

Once I disabled this policy I was able to become a passwordless user with Ansible with no issues. In terms of how to define the variables you can either not define `ansible_become_pass` or set it like

```
ansible_become_pass: ''
ansible_become_pass: null
```

and it will work. An empty string being passed into `LogonUser` is the same as null. Here is what I did to test this locally

```
- hosts: '2016'
  gather_facts: no
  tasks:
  - name: fail because passwordless auth is disabled
    win_command: whoami
    become: yes
    become_user: passwordless
    ignore_errors: yes

  - name: enable passwordless auth outside of console
    win_regedit:
      path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa
      name: LimitBlankPasswordUse
      data: 0
      type: dword
      state: present

  - name: run become with passwordless account
    win_command: whoami
    become: yes
    become_user: passwordless
```

Results in this

```
TASK [fail because passwordless auth is disabled] ************************************************************************************************************
task path: /Users/jborean/dev/module-tester/adhoc.yml:4
Tuesday 02 January 2018  07:47:40 +1000 (0:00:00.357)       0:00:00.357 *******
An exception occurred during task execution. To see the full traceback, use -vvv. The error was:     + FullyQualifiedErrorId : Win32Exception
fatal: [SERVER2016.domain.local]: FAILED! => {"changed": false, "msg": "Exception calling \"RunAsUser\" with \"5\" argument(s): \"LogonUser failed (Account restrictions are preventing this user from signing in. For example: blank passwords aren't allowed, sign-in times are limited, or a policy restriction has been enforced, Win32ErrorCode 1327)\""}
...ignoring

TASK [enable passwordless auth outside of console] ***********************************************************************************************************
task path: /Users/jborean/dev/module-tester/adhoc.yml:10
Tuesday 02 January 2018  07:47:41 +1000 (0:00:01.584)       0:00:01.941 *******
changed: [SERVER2016.domain.local] => {"changed": true, "data_changed": true, "data_type_changed": false}

TASK [run become with passwordless account] ******************************************************************************************************************
task path: /Users/jborean/dev/module-tester/adhoc.yml:18
Tuesday 02 January 2018  07:47:42 +1000 (0:00:01.113)       0:00:03.054 *******
changed: [SERVER2016.domain.local] => {"changed": true, "cmd": "whoami", "delta": "0:00:00.499346", "end": "2018-01-01 09:47:45.882475", "rc": 0, "start": "2018-01-01 09:47:45.383128", "stderr": "", "stderr_lines": [], "stdout": "server2016\\passwordless\r\n", "stdout_lines": ["server2016\\passwordless"]}
META: ran handlers
META: ran handlers

PLAY RECAP ***************************************************************************************************************************************************
SERVER2016.domain.local    : ok=3    changed=2    unreachable=0    failed=0
```

I'll create a PR to add this info to the docs.
@jborean93 Great, this works well for password-less users !

Now I am still looking for a solution for running something (as Administrator) for other users (of which you don't know the password). Probably belongs to a separate issue ?

Commit message: windows become - info about blank passwords

Patch to review:
diff --git a/docs/docsite/rst/become.rst b/docs/docsite/rst/become.rst
index 32b12cd5f9882c..38c98d1950f525 100644
--- a/docs/docsite/rst/become.rst
+++ b/docs/docsite/rst/become.rst
@@ -420,6 +420,38 @@ Because local service accounts do not have passwords, the
 ``ansible_become_password`` parameter is not required and is ignored if
 specified.
 
+Accounts without a Password
+---------------------------
+
+.. Warning:: Not setting a password for a Windows account is not recommended
+    and should be avoided in most scenarios. There are some security
+    restrictions that are set by default which would need to be bypassed to get
+    this working.
+
+Ansible can be used to become an account that does not have a password like the
+``Guest`` account. To become an account without a password, set up the
+variables like normal but either do not define ``ansible_become_pass`` or set
+``ansible_become_pass: ''``.
+
+Before become would work on an account like this, the local policy
+`Accounts: Limit local account use of blank passwords to console logon only <https://technet.microsoft.com/en-us/library/jj852174.aspx>`_
+must be disabled. This can either be done through a Group Policy Object (GPO)
+or with this Ansible task:
+
+.. code-block:: yaml
+
+   - name: allow blank password on become
+     win_regedit:
+       path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa
+       name: LimitBlankPasswordUse
+       data: 0
+       type: dword
+       state: present
+
+.. Note:: This is only for accounts that do not have a password. You still need
+    to set the account's password under ``ansible_become_pass`` if the
+    become_user has a password.
+
 Limitations
 -----------
 


Code review comments:
diff_hunk: @@ -420,6 +420,38 @@ Because local service accounts do not have passwords, the
 ``ansible_become_password`` parameter is not required and is ignored if
 specified.
 
+Accounts without a Password
+---------------------------
+
+.. Warning:: Not setting a password for a Windows account is not recommended
path: docs/docsite/rst/become.rst
text: @user1:
Double negative