0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

@ooki

【Ansible】Windows Serverをターゲットとしたbecomeの利用について

0
Posted at

はじめに

Ansibleではインベントリファイルでなどで定義したansible_userのユーザー情報を利用してターゲットノードに接続し、タスクを実行します。

ターゲットノードがWindowsの場合は、以下のようにbecomeパラメータを指定するのみではエラーとなってしまいます。

---
- name: Test Playbook
  hosts: WindowsServers
  gather_facts: false
  tasks:
    - name: 疎通確認
      ansible.windows.win_ping:
      become: true

※デフォルトだとbecome_methodにsudoが指定されているため、Wndowsでは以下のエラーが発生します。

The powershell shell family is incompatible with the sudo become plugin

今回は、Windows Serverを対象するPlaybookで、becomeパラメータを利用する方法についてまとめたいと思います。

becomeを利用したタスクの実行

前述の通り、Windowsではbecomeパラメータを利用する際、Linuxのようにbecome: trueのみでは動作しません。
runasを指定し、実行するユーザーを指定する必要があります。

別ユーザーとして実行

別ユーザーとしてタスクを実行するには、通常は以下のパラメータを指定します

  • become: true
  • become_method: runas
  • become_user: <ユーザー名>
  • become_password: <パスワード>
    ※ユーザーにSystemやNetworkServiceを指定する場合は、パスワードは不要です。

Playbookは以下のようになります。

---
- name: Test Playbook
  hosts: WindowsServers
  gather_facts: false
  tasks:
    - name: ユーザー情報取得
      ansible.windows.win_whoami:
      become: true
      become_method: ansible.builtin.runas
      become_user: System

実行すると、SYSTEMユーザーでタスクが実行されたことを確認できます。

{"account": {"account_name": "SYSTEM", "domain_name": "NT AUTHORITY", "sid": "S-1-5-18", "type": "User"},..

特定のタスクのみ別ユーザーで実行したい場合はこちらの方法で解決することができます。

同じユーザーで実行する

becomeは主に別ユーザーとしてタスクを実行ために使用しますが、Windowsでは別の用途としても利用できます。
その1つが、WinRM上で実行する際の制限を回避することです。
これにより、ネットワーク委任の制限やWindows Update APIのような禁止されているシステムコールへのアクセスが可能になります。

実際に、同じユーザーでbecomeを実行した場合にwhoamiがどのように変わるのか確認してみます。
以下のPlaybookでbecomeありとbecomeなしのjsonを出力し、比較します。

---
- name: Test Playbook
  hosts: WindowsServers
  gather_facts: false
  tasks:
    - name: ユーザー情報取得（becomeなし）
      ansible.windows.win_whoami:
      register: not_become_result

    - name: ユーザー情報取得（becomeあり）
      ansible.windows.win_whoami:
      become: true
      become_method: ansible.builtin.runas
      become_user: Administrator
      register: sameuser_become_result

    - name: 結果出力 (becomeなし)
      ansible.windows.win_copy:
        content: "{{ not_become_result | to_nice_json(ensure_ascii=false) }}"
        dest: C:\temp\not_become.json

    - name: 結果出力 (becomeあり)
      ansible.windows.win_copy:
        content: "{{ sameuser_become_result | to_nice_json(ensure_ascii=false) }}"
        dest: C:\temp\sameuser_become.json

それぞれ出力結果は下記の通りです。

not_become.json 
{
    "account": {
        "account_name": "Administrator",
        "domain_name": "WIN2025N01",
        "sid": "S-1-5-21-1175430086-1832433611-1499378413-500",
        "type": "User"
    },
    "authentication_package": "NTLM",
    "changed": false,
    "dns_domain_name": "",
    "failed": false,
    "groups": [
        {
            "account_name": "なし",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "WIN2025N01",
            "sid": "S-1-5-21-1175430086-1832433611-1499378413-513",
            "type": "Group"
        },
        {
            "account_name": "Everyone",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "",
            "sid": "S-1-1-0",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "ローカル アカウントと Administrators グループのメンバー",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "NT AUTHORITY",
            "sid": "S-1-5-114",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "Administrators",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled",
                "Owner"
            ],
            "domain_name": "BUILTIN",
            "sid": "S-1-5-32-544",
            "type": "Alias"
        },
        {
            "account_name": "Users",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "BUILTIN",
            "sid": "S-1-5-32-545",
            "type": "Alias"
        },
        {
            "account_name": "NETWORK",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "NT AUTHORITY",
            "sid": "S-1-5-2",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "Authenticated Users",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "NT AUTHORITY",
            "sid": "S-1-5-11",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "This Organization",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "NT AUTHORITY",
            "sid": "S-1-5-15",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "ローカル アカウント",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "NT AUTHORITY",
            "sid": "S-1-5-113",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "NTLM Authentication",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "NT AUTHORITY",
            "sid": "S-1-5-64-10",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "High Mandatory Level",
            "attributes": [
                "Integrity",
                "Integrity enabled"
            ],
            "domain_name": "Mandatory Label",
            "sid": "S-1-16-12288",
            "type": "Label"
        }
    ],
    "impersonation_level": "SecurityAnonymous",
    "label": {
        "account_name": "High Mandatory Level",
        "domain_name": "Mandatory Label",
        "sid": "S-1-16-12288",
        "type": "Label"
    },
    "login_domain": "WIN2025N01",
    "login_time": "2026-07-22T23:17:56.0095741+09:00",
    "logon_id": 14629022,
    "logon_server": "WIN2025N01",
    "logon_type": "Network",
    "privileges": {
        "SeBackupPrivilege": "enabled-by-default",
        "SeChangeNotifyPrivilege": "enabled-by-default",
        "SeCreateGlobalPrivilege": "enabled-by-default",
        "SeCreatePagefilePrivilege": "enabled-by-default",
        "SeCreateSymbolicLinkPrivilege": "enabled-by-default",
        "SeDebugPrivilege": "enabled-by-default",
        "SeDelegateSessionUserImpersonatePrivilege": "enabled-by-default",
        "SeImpersonatePrivilege": "enabled-by-default",
        "SeIncreaseBasePriorityPrivilege": "enabled-by-default",
        "SeIncreaseQuotaPrivilege": "enabled-by-default",
        "SeIncreaseWorkingSetPrivilege": "enabled-by-default",
        "SeLoadDriverPrivilege": "enabled-by-default",
        "SeManageVolumePrivilege": "enabled-by-default",
        "SeProfileSingleProcessPrivilege": "enabled-by-default",
        "SeRemoteShutdownPrivilege": "enabled-by-default",
        "SeRestorePrivilege": "enabled-by-default",
        "SeSecurityPrivilege": "enabled-by-default",
        "SeShutdownPrivilege": "enabled-by-default",
        "SeSystemEnvironmentPrivilege": "enabled-by-default",
        "SeSystemProfilePrivilege": "enabled-by-default",
        "SeSystemtimePrivilege": "enabled-by-default",
        "SeTakeOwnershipPrivilege": "enabled-by-default",
        "SeTimeZonePrivilege": "enabled-by-default",
        "SeUndockPrivilege": "enabled-by-default"
    },
    "rights": [
        "SeNetworkLogonRight",
        "SeInteractiveLogonRight",
        "SeBatchLogonRight",
        "SeRemoteInteractiveLogonRight"
    ],
    "token_type": "TokenPrimary",
    "upn": "",
    "user_flags": []
}
...
sameuser_become.json 
{
    "account": {
        "account_name": "Administrator",
        "domain_name": "WIN2025N01",
        "sid": "S-1-5-21-1175430086-1832433611-1499378413-500",
        "type": "User"
    },
    "authentication_package": "NTLM",
    "changed": false,
    "dns_domain_name": "",
    "failed": false,
    "groups": [
        {
            "account_name": "なし",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "WIN2025N01",
            "sid": "S-1-5-21-1175430086-1832433611-1499378413-513",
            "type": "Group"
        },
        {
            "account_name": "Everyone",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "",
            "sid": "S-1-1-0",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "ローカル アカウントと Administrators グループのメンバー",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "NT AUTHORITY",
            "sid": "S-1-5-114",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "Administrators",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled",
                "Owner"
            ],
            "domain_name": "BUILTIN",
            "sid": "S-1-5-32-544",
            "type": "Alias"
        },
        {
            "account_name": "Users",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "BUILTIN",
            "sid": "S-1-5-32-545",
            "type": "Alias"
        },
        {
            "account_name": "REMOTE INTERACTIVE LOGON",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "NT AUTHORITY",
            "sid": "S-1-5-14",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "INTERACTIVE",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "NT AUTHORITY",
            "sid": "S-1-5-4",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "Authenticated Users",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "NT AUTHORITY",
            "sid": "S-1-5-11",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "This Organization",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "NT AUTHORITY",
            "sid": "S-1-5-15",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "ローカル アカウント",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "NT AUTHORITY",
            "sid": "S-1-5-113",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "LOCAL",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "",
            "sid": "S-1-2-0",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "NTLM Authentication",
            "attributes": [
                "Mandatory",
                "Enabled by default",
                "Enabled"
            ],
            "domain_name": "NT AUTHORITY",
            "sid": "S-1-5-64-10",
            "type": "WellKnownGroup"
        },
        {
            "account_name": "High Mandatory Level",
            "attributes": [
                "Integrity",
                "Integrity enabled"
            ],
            "domain_name": "Mandatory Label",
            "sid": "S-1-16-12288",
            "type": "Label"
        }
    ],
    "impersonation_level": "SecurityAnonymous",
    "label": {
        "account_name": "High Mandatory Level",
        "domain_name": "Mandatory Label",
        "sid": "S-1-16-12288",
        "type": "Label"
    },
    "login_domain": "WIN2025N01",
    "login_time": "2026-07-22T23:11:36.1526374+09:00",
    "logon_id": 321859,
    "logon_server": "WIN2025N01",
    "logon_type": "RemoteInteractive",
    "privileges": {
        "SeBackupPrivilege": "disabled",
        "SeChangeNotifyPrivilege": "enabled-by-default",
        "SeCreateGlobalPrivilege": "enabled-by-default",
        "SeCreatePagefilePrivilege": "disabled",
        "SeCreateSymbolicLinkPrivilege": "disabled",
        "SeDebugPrivilege": "enabled",
        "SeDelegateSessionUserImpersonatePrivilege": "disabled",
        "SeImpersonatePrivilege": "enabled-by-default",
        "SeIncreaseBasePriorityPrivilege": "disabled",
        "SeIncreaseQuotaPrivilege": "disabled",
        "SeIncreaseWorkingSetPrivilege": "disabled",
        "SeLoadDriverPrivilege": "disabled",
        "SeManageVolumePrivilege": "disabled",
        "SeProfileSingleProcessPrivilege": "disabled",
        "SeRemoteShutdownPrivilege": "disabled",
        "SeRestorePrivilege": "disabled",
        "SeSecurityPrivilege": "disabled",
        "SeShutdownPrivilege": "disabled",
        "SeSystemEnvironmentPrivilege": "disabled",
        "SeSystemProfilePrivilege": "disabled",
        "SeSystemtimePrivilege": "disabled",
        "SeTakeOwnershipPrivilege": "disabled",
        "SeTimeZonePrivilege": "disabled",
        "SeUndockPrivilege": "disabled"
    },
    "rights": [
        "SeNetworkLogonRight",
        "SeInteractiveLogonRight",
        "SeBatchLogonRight",
        "SeRemoteInteractiveLogonRight"
    ],
    "token_type": "TokenPrimary",
    "upn": "",
    "user_flags": [
        "Winlogon"
    ]
}
...

becomeパラメータなしのタスクでは、logon_typeがNetworkになっているのに対し、becomeパラメータを付与するとRemoteInteractiveとなっています。

logon_typeがinteractiveの場合はWinRMのすべての制限が回避される旨、ドキュメント上に記載があります。
Networkの場合は、通常のWinRMプロセスを実行する場合と同じ制限が課される旨の記載があります。

・interactive: The default logon type. The process will be run under a context that is the same as when running a process locally. This bypasses all WinRM restrictions and is the recommended method to use.
・network: Runs the process under a network context without any cached credentials. This results in the same type of logon session as running a normal WinRM process without credential delegation and operates under the same restrictions.

このことから、becomeでansible_userと同じユーザーを指定するメリットを確認できました。

まとめ

Windows Serverでbecomeを利用する際のポイントは下記の通りです。

  • become_method: runasを指定する
  • 接続時と別ユーザーとしてタスクを実行する場合は、become_userで対象ユーザーを指定する
  • become_userに接続時と同じユーザーを指定すると、WinRMの制限を回避できる

参考

0
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?