# Dynamic inventory from Active Directory? **URL:** \ **Category:** Ansible Developer\ **Tags:** windows\ **Created:** [September 21, 2015, 7:31pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-active-directory/19319 "2015-09-21T19:31:43Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Bob\_Tanner](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@Bob\_Tanner](https://forum.ansible.com/u/Bob_Tanner)\ **Post date:** [September 21, 2015, 7:31pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-active-directory/19319/1 "2015-09-21T19:31:43Z")
Is there a way to build a dynamic inventory from Active Directory? Given you cannot use Windows as a control host fun things like pyad and py32win aren’t going to work to pull stuff out of Active Directory. Is this a sales point for Tower? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [September 21, 2015, 7:32pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-active-directory/19319/2 "2015-09-21T19:32:49Z")
you can query AD as an ldap server, so it should not be hard to make a script to use it as an inventory source. ---
**Author:** ![Trond\_Hindenes](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@Trond\_Hindenes](https://forum.ansible.com/u/Trond_Hindenes)\ **Post date:** [September 21, 2015, 10:37pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-active-directory/19319/3 "2015-09-21T22:37:24Z")
That’s a great suggestion Bob. Given my very limited understading of Ansible I’ve written a few inventory APIs on [asp.net](http://asp.net) web api, and a very simple python script which just gets json data from those api’s (with some optional caching). For now I have apis for building inventories from Azure Resouce Manager and Virtual Machine Manager, which can be found here: [https://github.com/trondhindenes/armrest](https://github.com/trondhindenes/armrest) [https://github.com/trondhindenes/VMmDynamicInventory](https://github.com/trondhindenes/VMmDynamicInventory) The latter one just invokes PowerShell to query VMM on the server running the web api, so it shouldn’t be too hard to maybe build that into a ad-querying thing instead. I’ll probably have a look at that at some point. ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [September 22, 2015, 12:28am UTC](https://forum.ansible.com/t/dynamic-inventory-from-active-directory/19319/4 "2015-09-22T00:28:44Z")
This can be done in any language that has an LDAP library, just query the domain with "(&(objectClass=computer))" as your search parameter. ---
**Author:** ![Bob\_Tanner](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@Bob\_Tanner](https://forum.ansible.com/u/Bob_Tanner)\ **Post date:** [September 27, 2015, 8:56pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-active-directory/19319/5 "2015-09-27T20:56:34Z")
Anyone playing around with this look at ldap3: [http://ldap3.readthedocs.org/en/latest/tutorial.html](http://ldap3.readthedocs.org/en/latest/tutorial.html) Not python-ldap. ldap3 has the ability to convert searches into JSON. ---
**Author:** ![Bob\_Tanner](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@Bob\_Tanner](https://forum.ansible.com/u/Bob_Tanner)\ **Post date:** [October 12, 2015, 8:27pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-active-directory/19319/6 "2015-10-12T20:27:35Z")
Gotten something working but run into a security problem. How and where do you store the username and password **securely** for these dynamic inventory scripts/programs? Looking at the contrib/inventory all the .ini files look to store the credentials in clear text. In my script can I programmatically extend the ansible-vault functionality so I can at least encrypt the .ini file? ---
**Author:** ![esco\_real](https://avatars.discourse-cdn.com/v4/letter/e/c89c15/32.png) [@esco\_real](https://forum.ansible.com/u/esco_real)\ **Post date:** [October 13, 2015, 12:10pm UTC](https://forum.ansible.com/t/dynamic-inventory-from-active-directory/19319/7 "2015-10-13T12:10:48Z")
Hello Bob, I would use a dedicated user without any further permission in the AD. And if the system you are running Ansible on is not secure enough to store this then this is quite a challenge 😉 But some alternative approach: I like to use KeePass 2 databases for storing passwords (and other sensitive information). In Python you can use this with libkeepass. esco