win_service: does not support virtual account about ansible.windows

[jborean93]

From @jborean93 on Feb 04, 2020 22:58

@agowa338 virtual accounts should follow the format NT SERVICE\<service name> so in your case NT SERVICES\foobar. Managed service accounts are the ones that should end with $ not virtual accounts.

But even then it is still failing for me so we need to fix this up.

[jborean93]

From @briantist on Feb 12, 2020 03:45

This is the same issue with using gMSAs in scheduled tasks from #60990 . The password has to be null for the virtual account to work, but ansible won't let it.

https://github.com/ansible/ansible/blob/a61dcfd542d75a7477136d54bd9b02a8f3eae326/lib/ansible/modules/windows/win_service.ps1#L52-L54

Commenting out line 53 and then leaving out the password option when calling the module will make this work.

A full PR would have to check to ensure there's a useful error response in cases where a password was actually required, but a nice upside of enabling virtual accounts is that the same change should allow for a service to be configured with a gMSA as well.

I'll see if I can tackle this soon if no one else gets to it first.

[jborean93]

From @jborean93 on Feb 12, 2020 04:01

@briantist just an FYI I've got a WIP to overhaul the Windows service stuff in Ansible which should fix this. Feel free to open a PR if you have something ready but just be aware I've got something in the pipeline for this module.

[jborean93]

From @briantist on Feb 12, 2020 04:03

@briantist just an FYI I've got a WIP to overhaul the Windows service stuff in Ansible which should fix this. Feel free to open a PR if you have something ready but just be aware I've got something in the pipeline for this module.

Sounds good to me, appreciate the heads up, you might have saved my weekend ;)

[jborean93]

From @jborean93 on Feb 13, 2020 04:53

The PR ansible/ansible#67367 adds the C# util Ansible.Service that I am planning to get win_service to use instead of the various different sources it currently relies to manage services. I've tested that this util can correctly set the service account to both a virtual account and MSA so all that is needed for win_service to correctly support that.

Just need to finish a few other things first before getting onto win_service but it's nearly there.