Assign "system" rights to domain user id on windows 2016

Question

Hi,

Our automation team runs playbooks in Ansible to generate report on windows 2016 server. However, they are getting the below error. Can you please let me know what settings should be enabled so that domain id will get "system" rights on the server?

"fatal: [server name]: FAILED! => {"changed": false, "msg": "internal error: failed to become user 'system' : Exception calling \"CreateProcessAsUser\" with \"9"\ argument(s): \"Failed to get token for NT AUTHORITY\SYSTEM required for become as a service account or an account without a password\""}

Thanks,

Umesh.S.K

Answer 1

Hi,

NT AUTHORITY\SYSTEM is a powerful account that has most access to local system resources. For more information, please see Query : NT AUTHORITY\SYSTEM. Personally, I don't think it's feasible to assign NT AUTHORITY\SYSTEM's right to domain user.

Please also post this issue on Ansible Community. Users there are more familiar with this product and have more resources to help us solve this issue.

Ansible has a large and engaged community of users who can help answer your questions.

Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

----------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi,

The issue is still not resolved. I am not sure what and where to look. All we need is, domain account should run playbooks as "SYSTEM" on windows server. How to achieve it?

Answer 3

I had similar issue and it is with SeDebugPrivilage for the users. It is disabled as new Group policy removed users and groups from Windows settings -- security settings -- local policies -- user rights assignment -- debug programs

whoami /priv will show the SeDebugPrivilage for user that used to run script and it should be enabled. Please check if it helps