# Issue running get-aduser in powershell from playbook

**URL:** <https://forum.ansible.com/t/issue-running-get-aduser-in-powershell-from-playbook/37948>\
**Category:** Ansible Project\
**Tags:** windows, awx\
**Created:** [May 2, 2023, 1:27am UTC](https://forum.ansible.com/t/issue-running-get-aduser-in-powershell-from-playbook/37948 "2023-05-02T01:27:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gregory\_Machin](https://avatars.discourse-cdn.com/v4/letter/g/e5b9ba/32.png) [@Gregory\_Machin](https://forum.ansible.com/u/Gregory_Machin)\
**Post date:** [May 2, 2023, 1:27am UTC](https://forum.ansible.com/t/issue-running-get-aduser-in-powershell-from-playbook/37948/1 "2023-05-02T01:27:32Z")

</div>

Hi,

I’m currently testing using AWX as an API to run PowerShell commands via ansible playbooks.

I’m currently testing using the Get-AD user command as this is close to what I’ll be doing.

I’m using the following Ansible playbook

- name: Test Extra Variables and PowerShell Command  
hosts: all  
collections:  
tasks:

- name: Show Extra Variables  
debug:  
msg:

- “NewUserName: {{ NewUserName }}”

- “UserManager: {{ UserManager }}”

- name: Run PowerShell Command with SYSTEM account  
ansible.windows.win\_shell: |  
whoami  
Test-NetConnection server.Domain.local -port 9389  
Get-ADDomainController -ForceDiscover -Discover -Service ADWS -NextClosestSite  
Get-ADUser -Identity {{ NewUserName }}  
register: result

- name: Show PowerShell Command Result  
debug:  
var: result.stdout\_lines

but get-ADUser errors with :

Get-ADUser : Unable to contact the server. This may be because this server does not exist, it is currently down, or it  
does not have the Active Directory Web Services running.  
At line:4 char:1

- Get-ADUser -Identity bbuilder
- 

```auto

```

- CategoryInfo : ResourceUnavailable: (bbuilder:ADUser) [Get-ADUser], ADServerDownException
- FullyQualifiedErrorId : ActiveDirectoryServer:0,Microsoft.ActiveDirectory.Management.Commands.GetADUser

but I don’t have any issues running Get-ADUser under my account or the service account used for the playbook on the same server.

the following in the playbook work as expected:  
Test-NetConnection server.Domain.local -port 9389  
Get-ADDomainController -ForceDiscover -Discover -Service ADWS -NextClosestSite

It feels like there is something missing PowerShell environment used by Ansible, but I cant see what could cause this.

Please advise.

thank you  
G

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [May 2, 2023, 7:14pm UTC](https://forum.ansible.com/t/issue-running-get-aduser-in-powershell-from-playbook/37948/2 "2023-05-02T19:14:01Z")

</div>

This is most likely the double hop problem where the WinRM process on the Windows side is unable to authenticate itself when talking to a downstream server [1]

There are a few ways you can solve this

- Use become on the task [2]

- Use CredSSP as your authentication protocol with WinRM

- Setup Kerberos delegation through either

Jordan

[1] [https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/ps-remoting-second-hop?view=powershell-7.3](https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/ps-remoting-second-hop?view=powershell-7.3)  
[2] [https://docs.ansible.com/ansible/latest/playbook\_guide/playbooks\_privilege\_escalation.html#become-and-windows](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_privilege_escalation.html#become-and-windows)

---

<div class="post-metadata">

**Author:** ![Gregory\_Machin](https://avatars.discourse-cdn.com/v4/letter/g/e5b9ba/32.png) [@Gregory\_Machin](https://forum.ansible.com/u/Gregory_Machin)\
**Post date:** [May 4, 2023, 9:27am UTC](https://forum.ansible.com/t/issue-running-get-aduser-in-powershell-from-playbook/37948/3 "2023-05-04T09:27:57Z")

</div>

Hi Jordan,

Thanks for that, you resolved it.

for the next person this is what I ended up doing:

- name: Run PowerShell Command with SYSTEM account  
ansible.windows.win\_shell: |  
Get-ADUser -Identity {{ NewUserName }} -properties \*  
register: result  
become: yes  
become\_method: runas