ansible-collections / community.windows

Windows community collection for Ansible
https://galaxy.ansible.com/community/windows
GNU General Public License v3.0
205 stars 160 forks source link

adding "use_system_account" to work with GMSA accounts #574

Open IgorNik13 opened 4 months ago

IgorNik13 commented 4 months ago

Can you add a new use_system_account parameter and new rules to run a special account on a remote windows machine?

https://github.com/ansible-collections/community.windows/blob/e0e525555d93b229e19ec3b0b3ec37fcaaae858b/plugins/modules/psexec.py#L394


from pypsexec.client import Client

host = "win-host.domain1.lco"
user = "win_user@domain1.loc"
passw = "SecretPassword"
username_gmsa = "GMSA_LOGIN$"
working_directory = "C:\\"
c = Client(host, username=user, password=passw)
command = "echo Hello World"

c.connect()
try:
    c.create_service()
    stdout, stderr, rc = c.run_executable("cmd.exe",
                                          arguments="/c " + command, username=username_gmsa, use_system_account=True, working_dir=working_directory)
finally:
    c.remove_service()
    c.disconnect() ```

    process_username = module.params['process_username']
    process_password = module.params['process_password']
    use_system_account = module.params.get('use_system_account', False) # or something more appropriate
    use_system = False
    if process_username is not None and use_system_account == True:
        use_system = True # this works for me when I use special GMSA accounts to run commands on windows using cmd or powershell
        process_username = process_username  ##
        process_password = None
jborean93 commented 3 months ago

The underlying Python library used by the psexec module uses the PAExec executable on the service side which does not support gMSA accounts the last time I checked.