Wsrtjtyk

Using Ansible 2.7, I want to change ACL for a particular Windows folder, if it exists.

Here the code I use :

  - name: check that folder exists

    win_stat:

      path: C:Program Files (x86)MyFolder

    register: folderPresent



  - name: cut ACL inheritance and copy existing ones

    win_acl_inheritance:

      path: C:Program Files (x86)MyFolder

      state: absent

      reorganize: yes

    when: folderPresent.stat.exists



  - name: Add write right for authenticated users

    win_acl:

      path: C:Program Files (x86)MyFolder

      user: ThisMachineUtilisateurs

      rights: Write

      type: allow

      state: present

      inherit: ContainerInherit, ObjectInherit

      propagation: 'InheritOnly'

    when: folderPresent.stat.exists

The problem occurs with the win_acl command. I get : "an error occurred when attempting to present Write permission(s) on C:Program Files (x86)MyFolder", followed by a french nessage "Impossible de traduire certaines ou toutes les références d'identité." (that translates to impossible to translate some or all identity references).

The Windows machines I am dealing with are installed in French, so my assumption is that I am not specifying the ACL target user correctly.

So far I have tried many variations for the "user" parameter for the win_acl command :

• ThisMachineUtilisateurs


• BUILTINUtilisateurs


• ThisMachineUsers


• S-1-5-32-545


• ...

But none of them works...

An Ansible bug affect win_acl when dealing with folders such as :

• c:Program Files


• c:Program Files (x86)


• c:Windows

So the workaround that worked for me was to use a Windows command instead of the Ansible win_acl module :

win_shell: icacls 'C:/Program Files (x86)/MyFolder/' /grant '*S-1-5-11:(OI)(CI)F' /T

Where :

• 
  'C:/Program Files (x86)/MyFolder/' target folder, using / and not , surrounded with quoted because of the spaces inside


• 
  *S-1-5-1 a well-known Windows SID for Authenticated Users, the star starts an SID instead of a group or a user name (I was not able here to use anything else than an SID)


• 
  (OI)(CI) : propagates inheritance to both files and folders


• 
  /T : do it recursively on sub-folders