problems running Ansible with become on domain-connected Windows Server
My problem resolves down to an issue with group policy, and is likely to be solved with the same answer as this question:

https://serverfault.com/questions/695839/error-1385-when-executing-runas-on-windows-enterprise-7

i.e. the required permissions for become to work on Windows, seem to be:


Allow Logon as a Service
Allow Logon Locally


Alternate Solution

reference


  batch: Runs the process under a batch context that is similar to a
  scheduled task with a password set. This should bypass most WinRM
  restrictions and is useful if the become_user is not allowed to log on
  interactively.


There is another permission called 'Allow Logon as a Batch Job". If the domain-user has this permission, the user can run scripts as though they were scheduled tasks.

You can run your scripts using Ansible become and change the logon type to batch as shown below: 

win_whoami:
    become: yes
    become_user: ''SOMEDOMAIN\SOMEUSER''
    become_method: runas
    become_flags: logon_type=batch