title: Ansible, windows - how to access network folder?
body: <p>I want to use Ansible to automate my deployment process. Let me say few words about it. Deployment process in my case consists of two steps: </p>
  
  <ul>
  <li><p>update DB (SQL Script)</p></li>
  <li><p>copy predefined set of files to various network folders (on different machines) </p></li>
  </ul>
  
  <p>For this purpose I use special selfwritten program called Installer.exe. If I run it myself it performes operations with my credentials. So it has all my rights, e.g. access to network folders and SQL Databese.
  <a href="https://i.stack.imgur.com/66fzg.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/66fzg.png" alt="enter image description here"></a>
  I want to use Ansible as wrapper for my program (Installer.exe), not instead of it. My target scenario - Ansible prepares configuration files and runs my installer on remote windows machine. I've faced a problem - <strong>my program run by Ansible hasn't my full rights</strong>. It can successfully access SQL Database 1 on the same machine, but can't access SQL Database 2 on remote machine or access network folder. I always get "access denied" on networks access, SQL Database says something about NT AUTHORITY\ANONYMOUS LOGON. <strong>It looks like double hop problem</strong>, but not exactly it as far as I understand it. Double hop is about service accounts, but I am trying to access remote server with my own personal accouns. </p>
  
  <p><strong>UPD 1</strong>:
  My variables for that group are:</p>
  
  <pre><code>ansible_user: qtros@ABC.RU
  ansible_port: 5986
  ansible_connection: winrm
  ansible_winrm_server_cert_validation: ignore
  ansible_winrm_operation_timeout_sec: 120
  ansible_winrm_read_timeout_sec: 150
  ansible_winrm_transport: kerberos
  ansible_winrm_kerberos_delegation: yes
  </code></pre>
  
  <p>Before any actions with Ansible I run the following command:</p>
  
  <pre><code>$&gt; kinit qtros@ABC.RU
  </code></pre>
  
  <p>and enter my password. Later if run klist I can see some valid tickets. I intended to use domain account, but not local system account. Am I doing it right?</p>
  
  <p><strong>UPD 2</strong>: if I add such command in playbook:</p>
  
  <pre><code>...
  raw: "klist"
  ...
  </code></pre>
  
  <p>I get something like:</p>
  
  <pre><code>fatal: [targetserver.abc.ru]: FAILED! =&gt; {"changed": true, "failed": true, "rc": 1, "stderr": "", "stdout": "\r\nCurrent LogonId is 0:0x20265db4\r\nError calling API LsaCallAuthenticationPackage (ShowTickets substatus): 1312\r\n\r\nklist failed with 0xc000005f/-1073741729: A specified logon session does not exist. It may already have been terminated.\r\n\r\n\r\n", "stdout_lines": ["", "Current LogonId is 0:0x20265db4", "Error calling API LsaCallAuthenticationPackage (ShowTickets substatus): 1312", "", "klist failed with 0xc000005f/-1073741729: A specified logon session does not exist. It may already have been terminated.", "", ""]}
  </code></pre>