realtime.win_map_drives

An Ansible role that maps persistent network drives on Windows 11 workstations in environments with no domain controller or Active Directory.

Instead of storing a Windows user's login password so Ansible can impersonate them (become/runas), this role deploys a per-user logon scheduled task using logon_type: interactive_token. Windows only runs that task once the target user has already authenticated interactively — so no password for that account is ever collected, transmitted, or stored anywhere in this role or its consumers. The mapping is created inside that user's own session at every logon, self-healing rather than depending on a one-time push having succeeded.

---

Requirements

Control Node

• Ansible core >= 2.20
• community.windows collection (for win_scheduled_task) — declared in requirements.yml; install with ansible-galaxy collection install -r requirements.yml

Managed Nodes

• Windows 11 Pro, Enterprise, or Education
• WinRM already enabled and reachable — this role does not bootstrap WinRM, that must already be done per-machine before this role can run against it
• No domain join required or assumed; designed specifically for workgroup (non-domain) fleets

---

Role Variables

Defaults (from defaults/main.yml)

win_map_drives: []

Variable Reference

win_map_drives is a list of dicts, one entry per drive mapping to deploy (one scheduled task per entry):

Key	Required	Description
letter	yes	Drive letter to map (e.g. M), without a colon.
path	yes	UNC path to map the drive to (e.g. \\samba\dfs).
username	yes	Local Windows account this mapping is created for. The scheduled task only ever runs inside this user's own interactive session — no password for this account is supplied or required.
share_username	no	Username to authenticate to path with, if the share needs credentials distinct from the Windows login (e.g. a local Samba account). Required if share_password is set.
share_password	no	Password for share_username. Only ever used inside the per-user logon task's own action script. Vault-encrypt this value. Required if share_username is set.

Example host_vars:

win_map_drives:
  - letter: M
    path: \\samba\dfs
    username: bruce
    share_username: bruce
    share_password: "{{ vault_bruce_samba_password }}"

This role has no OS-specific vars/ overrides — it targets Windows only, and vars/main.yml is an empty first_found fallback.

---

Dependencies

None.

---

Platform Support

Platform	Supported
Windows 11 Pro	Yes
Windows 11 Enterprise	Yes
Windows 11 Education	Yes
Windows Home	Untested
Windows Server	Untested
Domain-joined machines	Untested — this role is designed for, and only tested against, workgroup (non-domain) fleets

---

Task Flow

1. Preflight (tasks/preflight.yml, always runs) — checks:
   • ansible-core >= 2.20 on the control node
   • Target os_family is Windows
   • Every entry in win_map_drives has letter, path, and username
   • No entry sets share_password without also setting share_username
2. Drive-mapping logon task configuration (tasks/map_drives.yml):
   • Deploys one community.windows.win_scheduled_task per win_map_drives entry, triggered at logon for that entry's username, with logon_type: interactive_token
   • The task's action runs New-PSDrive -Persist against path, optionally supplying share_username/share_password as a credential if set

---

Example Playbook

- hosts: windows_workgroup
  gather_facts: true
  roles:
    - role: realtime.win_map_drives
      vars:
        win_map_drives:
          - letter: M
            path: \\samba\dfs
            username: "{{ ansible_facts['hostname'] | lower }}"

---

Security Notes

• No Windows account password is ever collected, transmitted, or stored by this role — logon_type: interactive_token requires none.
• share_password, if used, is a separate, IT-owned credential (never the target user's personal Windows login) and is marked no_log: true at both the argument-spec and task level.
• The rendered scheduled task definition (including any share_username/share_password baked into its action command line) is stored on the target machine's own Task Scheduler library, visible to local administrators on that machine — this is an accepted, known tradeoff, not a bug.
• This role assumes WinRM is already reachable on the target; it does not configure WinRM, transport, or certificate trust itself.

---

License

MIT — see LICENSE.

---

Author Information

Bob Tanner,