Ansible Windows ACL

Question

Using Ansible 2.7, I want to change ACL for a particular Windows folder, if it exists.

Here the code I use :

  - name: check that folder exists
    win_stat:
      path: C:\Program Files (x86)\MyFolder
    register: folderPresent

  - name: cut ACL inheritance and copy existing ones
    win_acl_inheritance:
      path: C:\Program Files (x86)\MyFolder
      state: absent
      reorganize: yes
    when: folderPresent.stat.exists

  - name: Add write right for authenticated users
    win_acl:
      path: C:\Program Files (x86)\MyFolder
      user: ThisMachine\Utilisateurs
      rights: Write
      type: allow
      state: present
      inherit: ContainerInherit, ObjectInherit
      propagation: 'InheritOnly'
    when: folderPresent.stat.exists

The problem occurs with the win_acl command. I get : "an error occurred when attempting to present Write permission(s) on C:\Program Files (x86)\MyFolder", followed by a french nessage "Impossible de traduire certaines ou toutes les références d'identité." (that translates to impossible to translate some or all identity references).

The Windows machines I am dealing with are installed in French, so my assumption is that I am not specifying the ACL target user correctly.

So far I have tried many variations for the "user" parameter for the win_acl command :

ThisMachine\Utilisateurs
BUILTIN\Utilisateurs
ThisMachine\Users
S-1-5-32-545
...

But none of them works...

user_6594759 · Answer

An Ansible bug affect win_acl when dealing with folders such as :

c:\Program Files
c:\Program Files (x86)
c:\Windows

So the workaround that worked for me was to use a Windows command instead of the Ansible win_acl module :

win_shell: icacls 'C:/Program Files (x86)/MyFolder/' /grant '*S-1-5-11:(OI)(CI)F' /T

Where :

'C:/Program Files (x86)/MyFolder/' target folder, using / and not \, surrounded with quoted because of the spaces inside
*S-1-5-1 a well-known Windows SID for Authenticated Users, the star starts an SID instead of a group or a user name (I was not able here to use anything else than an SID)
(OI)(CI) : propagates inheritance to both files and folders
/T : do it recursively on sub-folders

Ansible Windows ACL

1 Answers