a0495fc314
* Update triple single quotes to triple double quotes This change was fully automated. The updated Python files have been verified to tokenize the same as the originals, except for the expected change in quoting of strings, which were verified through literal_eval. * Manual conversion of docstring quotes
109 lines
3.1 KiB
Python
109 lines
3.1 KiB
Python
#!/usr/bin/python
|
|
# -*- coding: utf-8 -*-
|
|
|
|
# Copyright: (c) 2017, Ansible Project
|
|
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
|
|
|
# this is a windows documentation stub. actual code lives in the .ps1
|
|
# file of the same name
|
|
|
|
ANSIBLE_METADATA = {'metadata_version': '1.1',
|
|
'status': ['preview'],
|
|
'supported_by': 'community'}
|
|
|
|
DOCUMENTATION = r"""
|
|
---
|
|
module: win_user_right
|
|
version_added: '2.4'
|
|
short_description: Manage Windows User Rights
|
|
description:
|
|
- Add, remove or set User Rights for a group or users or groups.
|
|
- You can set user rights for both local and domain accounts.
|
|
options:
|
|
name:
|
|
description:
|
|
- The name of the User Right as shown by the C(Constant Name) value from
|
|
U(https://technet.microsoft.com/en-us/library/dd349804.aspx).
|
|
- The module will return an error if the right is invalid.
|
|
type: str
|
|
required: yes
|
|
users:
|
|
description:
|
|
- A list of users or groups to add/remove on the User Right.
|
|
- These can be in the form DOMAIN\user-group, user-group@DOMAIN.COM for
|
|
domain users/groups.
|
|
- For local users/groups it can be in the form user-group, .\user-group,
|
|
SERVERNAME\user-group where SERVERNAME is the name of the remote server.
|
|
- You can also add special local accounts like SYSTEM and others.
|
|
- Can be set to an empty list with I(action=set) to remove all accounts
|
|
from the right.
|
|
type: list
|
|
required: yes
|
|
action:
|
|
description:
|
|
- C(add) will add the users/groups to the existing right.
|
|
- C(remove) will remove the users/groups from the existing right.
|
|
- C(set) will replace the users/groups of the existing right.
|
|
type: str
|
|
default: set
|
|
choices: [ add, remove, set ]
|
|
notes:
|
|
- If the server is domain joined this module can change a right but if a GPO
|
|
governs this right then the changes won't last.
|
|
seealso:
|
|
- module: win_group
|
|
- module: win_group_membership
|
|
- module: win_user
|
|
author:
|
|
- Jordan Borean (@jborean93)
|
|
"""
|
|
|
|
EXAMPLES = r"""
|
|
---
|
|
- name: Replace the entries of Deny log on locally
|
|
win_user_right:
|
|
name: SeDenyInteractiveLogonRight
|
|
users:
|
|
- Guest
|
|
- Users
|
|
action: set
|
|
|
|
- name: Add account to Log on as a service
|
|
win_user_right:
|
|
name: SeServiceLogonRight
|
|
users:
|
|
- .\Administrator
|
|
- '{{ansible_hostname}}\local-user'
|
|
action: add
|
|
|
|
- name: Remove accounts who can create Symbolic links
|
|
win_user_right:
|
|
name: SeCreateSymbolicLinkPrivilege
|
|
users:
|
|
- SYSTEM
|
|
- Administrators
|
|
- DOMAIN\User
|
|
- group@DOMAIN.COM
|
|
action: remove
|
|
|
|
- name: Remove all accounts who cannot log on remote interactively
|
|
win_user_right:
|
|
name: SeDenyRemoteInteractiveLogonRight
|
|
users: []
|
|
"""
|
|
|
|
RETURN = r"""
|
|
added:
|
|
description: A list of accounts that were added to the right, this is empty
|
|
if no accounts were added.
|
|
returned: success
|
|
type: list
|
|
sample: ["NT AUTHORITY\\SYSTEM", "DOMAIN\\User"]
|
|
removed:
|
|
description: A list of accounts that were removed from the right, this is
|
|
empty if no accounts were removed.
|
|
returned: success
|
|
type: list
|
|
sample: ["SERVERNAME\\Administrator", "BUILTIN\\Administrators"]
|
|
"""
|