# win_user_right – Manage Windows User Rights

New in version 2.4.

- Synopsis
- Parameters
- Notes
- See Also
- Examples
- Return Values
- Status

## Synopsis

- Add, remove or set User Rights for a group or users or groups.
- You can set user rights for both local and domain accounts.

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---

action
string

Choices:
- add
- remove
- set ←

`add` will add the users/groups to the existing right.
`remove` will remove the users/groups from the existing right.
`set` will replace the users/groups of the existing right.

name string / required |  | The name of the User Right as shown by the `Constant Name` value from https://technet.microsoft.com/en-us/library/dd349804.aspx. The module will return an error if the right is invalid.

users
list / required

A list of users or groups to add/remove on the User Right.
These can be in the form DOMAIN\user-group, user-group@DOMAIN.COM for domain users/groups.
For local users/groups it can be in the form user-group, .\user-group, SERVERNAME\user-group where SERVERNAME is the name of the remote server.
You can also add special local accounts like SYSTEM and others.
Can be set to an empty list with action=set to remove all accounts from the right.

## Notes

Note

- If the server is domain joined this module can change a right but if a GPO governs this right then the changes won’t last.

## See Also

See also

win_group – Add and remove local groups
  The official documentation on the win_group module.
win_group_membership – Manage Windows local group membership
  The official documentation on the win_group_membership module.
win_user – Manages local Windows user accounts
  The official documentation on the win_user module.

## Examples

    ---
    - name: Replace the entries of Deny log on locally
      win_user_right:
        name: SeDenyInteractiveLogonRight
        users:
        - Guest
        - Users
        action: set

    - name: Add account to Log on as a service
      win_user_right:
        name: SeServiceLogonRight
        users:
        - .\Administrator
        - '{{ansible_hostname}}\local-user'
        action: add

    - name: Remove accounts who can create Symbolic links
      win_user_right:
        name: SeCreateSymbolicLinkPrivilege
        users:
        - SYSTEM
        - Administrators
        - DOMAIN\User
        - group@DOMAIN.COM
        action: remove

    - name: Remove all accounts who cannot log on remote interactively
      win_user_right:
        name: SeDenyRemoteInteractiveLogonRight
        users: []

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
added list | success | A list of accounts that were added to the right, this is empty if no accounts were added. Sample: ['NT AUTHORITY\\SYSTEM', 'DOMAIN\\User']
removed list | success | A list of accounts that were removed from the right, this is empty if no accounts were removed. Sample: ['SERVERNAME\\Administrator', 'BUILTIN\\Administrators']

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by the Ansible Community. [community]

### Authors

- Jordan Borean (@jborean93)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.