# Handling changes to \`ansible\_user\` host/group var for Windows hosts that change Active Directory domain membership **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [June 24, 2016, 7:11pm UTC](https://forum.ansible.com/t/handling-changes-to-ansible-user-host-group-var-for-windows-hosts-that-change-active-directory-domain-membership/21858 "2016-06-24T19:11:12Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Kenny\_Evitt](https://avatars.discourse-cdn.com/v4/letter/k/9fc29f/32.png) [@Kenny\_Evitt](https://forum.ansible.com/u/Kenny_Evitt)\ **Post date:** [June 24, 2016, 7:11pm UTC](https://forum.ansible.com/t/handling-changes-to-ansible-user-host-group-var-for-windows-hosts-that-change-active-directory-domain-membership/21858/1 "2016-06-24T19:11:12Z")
I’m currently using Ansible to automate an Active Directory domain migration. I’m developing playbooks (and modules and, eventually, roles) in a test environment currently, but this particular issue seems applicable to any environment. My test environment only contains two hosts, both Windows hosts. One host is a clone of an existing Active Directory domain controller – a domain controller for the source domain of the domain migration I’m going to perform. The second host is a new server and will be the domain controller for the target domain of the domain migration. I’ve got a playbook that (successfully) sets-up a newly-created Windows host to server as a domain controller for a new Active Directory domain that is that target domain of the domain migration I’m testing. The final task of that playbook is a `script` task that promotes the relevant host to be a domain controller for the new domain. And it works! Yay Ansible! Now I’m working on a playbook to setup the new-domain domain controller host so I can perform the actual Active Directory migration. But now Ansible can’t connect. Because the two hosts are not initially members of the same domain, I can’t use the same domain account (via NTLM or Kerberos – I’m using NTLM currently) to connect with Ansible. I’ve got host-specific `ansible_user` variables for both defined. The problem is that for the second host, initially, before I promote it to be a domain controller for the new domain, I’ve configured the `ansible_user` to be a _local_ administrator account, i.e. an account for that host itself and not part of a domain. But – and this is specific to Windows and Active Directory – after I promote the host to be a domain controller, _local_ accounts can no longer be used (and, in fact, the local admin account is converted to an admin account for the new domain itself). Effectively, I need to use two different user accounts before and after the promotion. I think that I might be able to get this to work with a custom dynamic inventory, but [a blog post from March about Windows features](https://www.ansible.com/blog/ansible-windows-features) mentions: > In future releases, we’ll include modules to allow basic management of Windows domains, including domain-join/leave, promotion/demotion of domain controllers, domain user management, and even deployment of entirely new forests/domains. Anyone know or have an idea how promotion/demotion will work with Ansible’s authentication? This blog post by TechRabbit describes an idea that seems promising – implement a custom dynamic inventory that leverages an existing (static) inventory defined in the conventional files in the main Ansible repo. Any other ideas or suggestions would be appreciated. Thanks, Kenny ---
**Author:** ![Kenny\_Evitt](https://avatars.discourse-cdn.com/v4/letter/k/9fc29f/32.png) [@Kenny\_Evitt](https://forum.ansible.com/u/Kenny_Evitt)\ **Post date:** [June 24, 2016, 9:23pm UTC](https://forum.ansible.com/t/handling-changes-to-ansible-user-host-group-var-for-windows-hosts-that-change-active-directory-domain-membership/21858/2 "2016-06-24T21:23:45Z")
I think I’ve got a workable solution for at least the short term. I move my _hosts_ file and the _host\_vars_ and _group\_vars_ directories inside a new _inventory_ directory. I created a Python script in the _inventory_ directory that just returns the `ansible_user` host variable for the relevant host in the `_meta` attribute (for the `--list` argument). I removed the `ansible_user` variable from the relevant host variable file. I was able to confirm that the variable is now being set by the script by running `ansible host-name -m debug -a "var=hostvars[inventory_hostname]"`. Right now I’ve simply hard-coded the new value for the `ansible_user` variable but it should be easy enough to modify it to use some kind of file or database to retrieve that value. It should also be easy enough to my modify my ‘promote to be a domain controller’ playbook to run a local task to update the same file or database too. ---
**Author:** ![Kenny\_Evitt](https://avatars.discourse-cdn.com/v4/letter/k/9fc29f/32.png) [@Kenny\_Evitt](https://forum.ansible.com/u/Kenny_Evitt)\ **Post date:** [June 27, 2016, 7:17pm UTC](https://forum.ansible.com/t/handling-changes-to-ansible-user-host-group-var-for-windows-hosts-that-change-active-directory-domain-membership/21858/3 "2016-06-27T19:17:45Z")
[I created a Gist with two Python files](https://gist.github.com/kenny-evitt/89cf66769788db19f5992d3f691063b4). One creates a SQLite database file with a single `host_vars` table. The second is my updated dynamic inventory script. It now retrieves all of the data from the SQLite database table and outputs the data as host variables in the expected JSON format. Is it crazy to consider encapsulating this setup as an Ansible role itself?