ansible/test/integration/targets/win_scheduled_task/tasks/principals.yml

437 lines
14 KiB
YAML
Raw Normal View History

---
- name: create test user
win_user:
name: '{{test_scheduled_task_user}}'
password: '{{test_scheduled_task_pass}}'
state: present
groups:
- Administrators
- name: task with password principal (check mode)
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
username: '{{test_scheduled_task_user}}'
password: '{{test_scheduled_task_pass}}'
logon_type: password
update_password: no
actions:
- path: cmd.exe
register: task_with_password_check
check_mode: yes
- name: get result of task with password principal (check mode)
win_scheduled_task_stat:
path: \
name: '{{test_scheduled_task_name}}'
register: task_with_password_result_check
- name: assert results of task with password principal (check mode)
assert:
that:
- task_with_password_check is changed
- task_with_password_result_check.task_exists == False
- name: task with password principal
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
username: '{{test_scheduled_task_user}}'
password: '{{test_scheduled_task_pass}}'
logon_type: password
update_password: no
actions:
- path: cmd.exe
register: task_with_password
- name: get result of task with password principal
win_scheduled_task_stat:
path: \
name: '{{test_scheduled_task_name}}'
register: task_with_password_result
- name: assert results of task with password principal
assert:
that:
- task_with_password is changed
- task_with_password_result.task_exists == True
- task_with_password_result.principal.group_id == None
- task_with_password_result.principal.logon_type == "TASK_LOGON_PASSWORD"
- task_with_password_result.principal.run_level == "TASK_RUNLEVEL_LUA"
- task_with_password_result.principal.user_id.endswith(test_scheduled_task_user)
- name: task with password principal (idempotent)
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
username: '{{test_scheduled_task_user}}'
password: '{{test_scheduled_task_pass}}'
logon_type: password
update_password: no
actions:
- path: cmd.exe
register: task_with_password_again
- name: assert results of task with password principal (idempotent)
assert:
that:
- task_with_password_again is not changed
- name: task with password principal force pass change
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
username: '{{test_scheduled_task_user}}'
password: '{{test_scheduled_task_pass}}'
logon_type: password
update_password: yes
actions:
- path: cmd.exe
register: task_with_password_force_update
- name: assert results of task with password principal force pass change
assert:
that:
- task_with_password_force_update is changed
- name: task with s4u principal (check mode)
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
username: '{{test_scheduled_task_user}}'
password: '{{test_scheduled_task_pass}}'
logon_type: s4u
update_password: no
actions:
- path: cmd.exe
register: task_with_s4u_check
check_mode: yes
- name: get result of task with s4u principal (check mode)
win_scheduled_task_stat:
path: \
name: '{{test_scheduled_task_name}}'
register: task_with_s4u_result_check
- name: assert results of task with s4u principal (check mode)
assert:
that:
- task_with_s4u_check is changed
- task_with_s4u_result_check.task_exists == True
- task_with_s4u_result_check.principal.group_id == None
- task_with_s4u_result_check.principal.logon_type == "TASK_LOGON_PASSWORD"
- task_with_s4u_result_check.principal.run_level == "TASK_RUNLEVEL_LUA"
- task_with_s4u_result_check.principal.user_id.endswith(test_scheduled_task_user)
- name: task with s4u principal
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
username: '{{test_scheduled_task_user}}'
password: '{{test_scheduled_task_pass}}'
logon_type: s4u
update_password: no
actions:
- path: cmd.exe
register: task_with_s4u
- name: get result of task with s4u principal
win_scheduled_task_stat:
path: \
name: '{{test_scheduled_task_name}}'
register: task_with_s4u_result
- name: assert results of task with s4u principal
assert:
that:
- task_with_s4u is changed
- task_with_s4u_result.task_exists == True
- task_with_s4u_result.principal.group_id == None
- task_with_s4u_result.principal.logon_type == "TASK_LOGON_S4U"
- task_with_s4u_result.principal.run_level == "TASK_RUNLEVEL_LUA"
- task_with_s4u_result.principal.user_id.endswith(test_scheduled_task_user)
- name: task with s4u principal (idempotent)
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
username: '{{test_scheduled_task_user}}'
password: '{{test_scheduled_task_pass}}'
logon_type: s4u
update_password: no
actions:
- path: cmd.exe
register: task_with_s4u_again
- name: assert results of task with s4u principal (idempotent)
assert:
that:
- task_with_s4u_again is not changed
- name: task with interactive principal (check mode)
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
username: '{{test_scheduled_task_user}}'
logon_type: interactive_token
actions:
- path: cmd.exe
register: task_with_interactive_check
check_mode: yes
- name: get result of task with interactive principal (check mode)
win_scheduled_task_stat:
path: \
name: '{{test_scheduled_task_name}}'
register: task_with_interactive_result_check
- name: assert results of task with interactive principal (check mode)
assert:
that:
- task_with_interactive_check is changed
- task_with_interactive_result_check.task_exists == True
- task_with_interactive_result_check.principal.group_id == None
- task_with_interactive_result_check.principal.logon_type == "TASK_LOGON_S4U"
- task_with_interactive_result_check.principal.run_level == "TASK_RUNLEVEL_LUA"
- task_with_interactive_result_check.principal.user_id.endswith(test_scheduled_task_user)
- name: task with interactive principal
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
username: '{{test_scheduled_task_user}}'
logon_type: interactive_token
actions:
- path: cmd.exe
register: task_with_interactive
- name: get result of task with interactive principal
win_scheduled_task_stat:
path: \
name: '{{test_scheduled_task_name}}'
register: task_with_interactive_result
- name: assert results of task with interactive principal
assert:
that:
- task_with_interactive is changed
- task_with_interactive_result.task_exists == True
- task_with_interactive_result.principal.group_id == None
- task_with_interactive_result.principal.logon_type == "TASK_LOGON_INTERACTIVE_TOKEN"
- task_with_interactive_result.principal.run_level == "TASK_RUNLEVEL_LUA"
- task_with_interactive_result.principal.user_id.endswith(test_scheduled_task_user)
- name: task with interactive principal (idempotent)
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
username: '{{test_scheduled_task_user}}'
logon_type: interactive_token
actions:
- path: cmd.exe
register: task_with_interactive_again
- name: assert results of task with interactive principal (idempotent)
assert:
that:
- task_with_interactive_again is not changed
- name: task with group principal (check mode)
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
group: Administrators
logon_type: group
actions:
- path: cmd.exe
register: task_with_group_check
check_mode: yes
- name: get result of task with group principal (check mode)
win_scheduled_task_stat:
path: \
name: '{{test_scheduled_task_name}}'
register: task_with_group_result_check
- name: assert results of task with group principal (check mode)
assert:
that:
- task_with_group_check is changed
- task_with_group_result_check.task_exists == True
- task_with_group_result_check.principal.group_id == None
- task_with_group_result_check.principal.logon_type == "TASK_LOGON_INTERACTIVE_TOKEN"
- task_with_group_result_check.principal.run_level == "TASK_RUNLEVEL_LUA"
- task_with_group_result_check.principal.user_id.endswith(test_scheduled_task_user)
- name: task with group principal
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
group: Administrators
logon_type: group
actions:
- path: cmd.exe
register: task_with_group
- name: get result of task with group principal
win_scheduled_task_stat:
path: \
name: '{{test_scheduled_task_name}}'
register: task_with_group_result
- name: assert results of task with group principal
assert:
that:
- task_with_group is changed
- task_with_group_result.task_exists == True
- task_with_group_result.principal.group_id == "BUILTIN\\Administrators"
- task_with_group_result.principal.logon_type == "TASK_LOGON_GROUP"
- task_with_group_result.principal.run_level == "TASK_RUNLEVEL_LUA"
- task_with_group_result.principal.user_id == None
- name: task with group principal (idempotent)
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
group: Administrators
logon_type: group
actions:
- path: cmd.exe
register: task_with_group_again
- name: assert results of task with group principal (idempotent)
assert:
that:
- task_with_group_again is not changed
- name: task with service account principal (check mode)
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
username: System
logon_type: service_account
action:
- path: cmd.exe
register: task_with_service_check
check_mode: yes
- name: get result of task with service account principal (check mode)
win_scheduled_task_stat:
path: \
name: '{{test_scheduled_task_name}}'
register: task_with_service_result_check
- name: assert results of task with service account principal (check mode)
assert:
that:
- task_with_service_check is changed
- task_with_service_result_check.task_exists == True
- task_with_service_result_check.principal.group_id == "BUILTIN\\Administrators"
- task_with_service_result_check.principal.logon_type == "TASK_LOGON_GROUP"
- task_with_service_result_check.principal.run_level == "TASK_RUNLEVEL_LUA"
- task_with_service_result_check.principal.user_id == None
- name: task with service account principal
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
username: System
logon_type: service_account
action:
- path: cmd.exe
register: task_with_service
- name: get result of task with service account principal
win_scheduled_task_stat:
path: \
name: '{{test_scheduled_task_name}}'
register: task_with_service_result
- name: assert results of task with service account principal
assert:
that:
- task_with_service is changed
- task_with_service_result.task_exists == True
- task_with_service_result.principal.group_id == None
- task_with_service_result.principal.logon_type == "TASK_LOGON_SERVICE_ACCOUNT"
- task_with_service_result.principal.run_level == "TASK_RUNLEVEL_LUA"
- task_with_service_result.principal.user_id == "NT AUTHORITY\\SYSTEM"
- name: task with service account principal (idempotent)
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
username: System
logon_type: service_account
action:
- path: cmd.exe
register: task_with_service_again
- name: assert results of task with service account principal (idempotent)
assert:
that:
- task_with_service_again is not changed
- name: task with highest privilege (check mode)
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
run_level: highest
username: System
logon_type: service_account
action:
- path: cmd.exe
register: task_with_highest_privilege_check
check_mode: yes
- name: get result of task with highest privilege (check mode)
win_scheduled_task_stat:
path: \
name: '{{test_scheduled_task_name}}'
register: task_with_highest_privilege_result_check
- name: assert results of task with highest privilege (check mode)
assert:
that:
- task_with_highest_privilege_check is changed
- task_with_highest_privilege_result_check.principal.run_level == "TASK_RUNLEVEL_LUA"
- name: task with highest privilege
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
run_level: highest
username: System
logon_type: service_account
action:
- path: cmd.exe
register: task_with_highest_privilege
- name: get result of task with highest privilege
win_scheduled_task_stat:
path: \
name: '{{test_scheduled_task_name}}'
register: task_with_highest_privilege_result
- name: assert results of task with highest privilege
assert:
that:
- task_with_highest_privilege is changed
- task_with_highest_privilege_result.principal.run_level == "TASK_RUNLEVEL_HIGHEST"
- name: task with highest privilege (idempotent)
win_scheduled_task:
name: '{{test_scheduled_task_name}}'
state: present
run_level: highest
username: System
logon_type: service_account
action:
- path: cmd.exe
register: task_with_highest_privilege_again
- name: assert results of task with highest privilege (idempotent)
assert:
that:
- task_with_highest_privilege_again is not changed