# Exclude match from with\_items

**URL:** <https://forum.ansible.com/t/exclude-match-from-with-items/29451>\
**Category:** Ansible Project\
**Created:** [January 16, 2019, 10:51pm UTC](https://forum.ansible.com/t/exclude-match-from-with-items/29451 "2019-01-16T22:51:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Harmon](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@John\_Harmon](https://forum.ansible.com/u/John_Harmon)\
**Post date:** [January 16, 2019, 10:51pm UTC](https://forum.ansible.com/t/exclude-match-from-with-items/29451/1 "2019-01-16T22:51:59Z")

</div>

How might I go about excluding one item found under with\_items?

For example, assume the following:

`  
ok: [mytestserver] =\> {  
“aduser”: {  
“account\_locked”: false,  
“attempts”: 1,  
“changed”: false,  
“city”: “Spanish Fork”,  
“company”: “My Test Company”,  
“country”: “US”,  
“description”: “Regular User”,  
“distinguished\_name”: “CN=Gomer Pyle,OU=Administration,DC=MyTestCo,DC=com”,  
“email”: “[GPyle@MyTestCo.com](mailto:GPyle@MyTestCo.com)”,  
“enabled”: true,  
“failed”: false,  
“firstname”: “Gomer”,  
“groups”: [  
“Domain Users”,  
“IT Admins”,  
“Citrix”,  
“Misc”

`

I would like to remove the above user from all groups, except for “Domain Users”… Unsure how to approach it in this scenario:

`  
tasks:

- name: “Disable non-vip user {{ user }}”  
win\_domain\_user:  
name: “{{ user }}”  
password: $1$SomeSalt$tNt/ObWy40s.iTT/tmGYV.  
account\_locked: yes  
groups: “{{ item }}”  
groups\_action: remove  
with\_items:
- aduser.groups

`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [January 16, 2019, 11:11pm UTC](https://forum.ansible.com/t/exclude-match-from-with-items/29451/2 "2019-01-16T23:11:13Z")

</div>

Im unclear on what you want, but `when` executes PER loop iteration,  
so you can check `item` and skip that iteration depending on the  
condition you want.

---

<div class="post-metadata">

**Author:** ![John\_Harmon](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@John\_Harmon](https://forum.ansible.com/u/John_Harmon)\
**Post date:** [January 16, 2019, 11:14pm UTC](https://forum.ansible.com/t/exclude-match-from-with-items/29451/3 "2019-01-16T23:14:36Z")

</div>

I should clarify a little. I want to remove all groups except “Domain Users” from the user specified. I am also already using a when statement:

` `tasks:` `- name: “Disable non-vip user {{ user }}”` `win\_domain\_user:` `name: “{{ user }}”` `password: $1$SomeSalt$tNt/ObWy40s.iTT/tmGYV.` `account\_locked: yes` `groups: “{{ item }}”` `groups\_action: remove` `with\_items:` `- aduser.groups` `when:` `- not vip`

`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [January 16, 2019, 11:24pm UTC](https://forum.ansible.com/t/exclude-match-from-with-items/29451/4 "2019-01-16T23:24:51Z")

</div>

well, just reading teh docs on win\_domain\_user, seems you want`  
group\_action: replace`

---

<div class="post-metadata">

**Author:** ![John\_Harmon](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@John\_Harmon](https://forum.ansible.com/u/John_Harmon)\
**Post date:** [January 16, 2019, 11:30pm UTC](https://forum.ansible.com/t/exclude-match-from-with-items/29451/5 "2019-01-16T23:30:01Z")

</div>

I re-read you response Brian… I should be able to append to my when statement with an and statement or something similar. I will have to go and test it out.

---

<div class="post-metadata">

**Author:** ![John\_Harmon](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@John\_Harmon](https://forum.ansible.com/u/John_Harmon)\
**Post date:** [January 16, 2019, 11:35pm UTC](https://forum.ansible.com/t/exclude-match-from-with-items/29451/6 "2019-01-16T23:35:22Z")

</div>

> I re-read you response Brian… I should be able to append to my when statement with an and statement or something similar. I will have to go and test it out.

Wow, I totally missed that. That should do exactly what I want to. Thank you!