# Create windows user with temporary password

**URL:** <https://forum.ansible.com/t/create-windows-user-with-temporary-password/27913>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [June 29, 2018, 2:07pm UTC](https://forum.ansible.com/t/create-windows-user-with-temporary-password/27913 "2018-06-29T14:07:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vincent\_Mercier](https://avatars.discourse-cdn.com/v4/letter/v/b5e925/32.png) [@Vincent\_Mercier](https://forum.ansible.com/u/Vincent_Mercier)\
**Post date:** [June 29, 2018, 2:07pm UTC](https://forum.ansible.com/t/create-windows-user-with-temporary-password/27913/1 "2018-06-29T14:07:33Z")

</div>

Hi Ansible community,

I’m wondering how to create Windows users with a temporary password.  
A common workflow is to create users with a temporary password, send the temporary password and force users to change their password during first login.

Maybe I’m wrong but [win\_user module](https://docs.ansible.com/ansible/latest/modules/win_user_module.html) can’t do that because “password\_expired” is not limited by “update\_password: on\_create” (Should be [here](https://github.com/ansible/ansible/blob/d8a9b9f347ccbd09316ab6a8ae9fcfa516aa506d/lib/ansible/modules/windows/win_user.ps1#L133) in source code).

So password is configured as “expired” on each Ansible execution.

I tried to do this:

- name: Create windows users  
win\_user:  
name: “{{ item.username }}”  
password: “{{ item.initial\_password }}”  
password\_expired: yes  
update\_password: on\_create  
fullname: “{{ item.fullname }}”  
description: “{{ item.description }}”  
groups:
- Users  
state: present

This code works well to create users but force expiration everytime.

I’m wondering if there is a method to create Windows users with a temporary password and force them to change it during first login?

Thanks for your help,

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [July 2, 2018, 5:24pm UTC](https://forum.ansible.com/t/create-windows-user-with-temporary-password/27913/2 "2018-07-02T17:24:54Z")

</div>

Not tried this, but you might be able to do this with two win\_user tasks.

Assuming you don’t set `password_expired: yes`,if you use `register` on the result of the first one, then you will have recorded in the registered var whether user already existed, or whether they were created on this run.

Then you can run a second 'win\_user` only on the users which were created this time and set whatever password expiry or other user attributes only for newly-created users.

Something like this:

`

- name: User management test  
hosts: “10,”  
gather\_facts: False  
vars:  
my\_users:
- { username: bob, initial\_password: seekrit, fullname: “Robert Asker”, description: “Test Ask User” }
- { username: alice, initial\_password: seekrit, fullname: “Alice Answerer”, description: “Test Answer User” }
- { username: malcolm, initial\_password: seekrit, fullname: “Malcolm InTheMiddle”, description: “Test MITM User” }

tasks:

- name: Ensure windows users are present  
win\_user:  
name: “{{ item.username }}”  
password: “{{ item.initial\_password }}”  
update\_password: on\_create  
fullname: “{{ item.fullname }}”  
description: “{{ item.description }}”  
groups:

- Users  
state: present  
with\_items: “{{my\_users}}”  
register: ensure\_users

- name: view ensure user results  
debug:  
var: ensure\_users

- name: Expire password of newly-created windows users  
win\_user:  
name: “{{ item.name }}”  
password\_expired: yes  
update\_password: always  
state: present  
with\_items: “{{ ensure\_users.results}}”  
when: item is changed  
`