# Unable to remove user accounts from Cisco switches running IOS 12.x with Ansible module ios\_user: **URL:** \ **Category:** Ansible Project\ **Created:** [October 2, 2018, 4:02pm UTC](https://forum.ansible.com/t/unable-to-remove-user-accounts-from-cisco-switches-running-ios-12-x-with-ansible-module-ios-user/28704 "2018-10-02T16:02:24Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![andrew.lemin](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@andrew.lemin](https://forum.ansible.com/u/andrew.lemin)\ **Post date:** [October 2, 2018, 4:02pm UTC](https://forum.ansible.com/t/unable-to-remove-user-accounts-from-cisco-switches-running-ios-12-x-with-ansible-module-ios-user/28704/1 "2018-10-02T16:02:24Z")
Hi, I just want to quickly check a finding with the community, something which should be so trivial it must be me 🙂 I have found that it is not possible to remove Cisco users from IOS 12.x using the Ansible module ios\_user: This is becuase IOS 12.x doesnt support “show running-config | section username” which the module tries to run. Ok, thats fair enough. So I’ll have to write the logic using ios\_config: module instead… But ios\_config: still does not seem to support ‘prompt:’ and ‘answer:’ ☹ Catch 22! As IOS prompts user removal with; “This operation will remove all username related configurations with same name.Do you want to continue? [confirm]” Thankfully, and only by dump luck, IOS 12 does not give this prompt, so ios\_config: does work… in this one case… Phew… But this to me seems like another exmaple of how much we need ios\_config: to support ‘prompt:’ and ‘answer:’ as Cisco IOS plays so poorly with Ansible compared to other vendors becuase of the Cisco CLI. Thanks for your thoughts. Kind regards, Andy Lemin ---
**Author:** ![Brad2](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@Brad2](https://forum.ansible.com/u/Brad2)\ **Post date:** [October 2, 2018, 4:11pm UTC](https://forum.ansible.com/t/unable-to-remove-user-accounts-from-cisco-switches-running-ios-12-x-with-ansible-module-ios-user/28704/2 "2018-10-02T16:11:57Z")
Can you upgrade your device to IOS 15.6 or greater? That might be easier than trying to find a work-around? ---
**Author:** ![andrew.lemin](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@andrew.lemin](https://forum.ansible.com/u/andrew.lemin)\ **Post date:** [October 3, 2018, 6:31am UTC](https://forum.ansible.com/t/unable-to-remove-user-accounts-from-cisco-switches-running-ios-12-x-with-ansible-module-ios-user/28704/3 "2018-10-03T06:31:08Z")
Morning Brad, I know in an ideal world, in a lab or a proof of concept, upgrading every device would be the obvious and easiest thing to do. But sadly when dealing with large brown-field networks. Their are often many technical and operational restrictions preventing an IOS upgrade. In this case, deploying key network automation functions is the very thing that will allow us to resolve some design factors, which in turn will ease upgrades to 15! So catch 22, we have to support IOS 12, to get to a place where we can realistically start upgrading all the legacy edge devices to IOS 15. Cheers, Andy. ---
**Author:** ![Brad2](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@Brad2](https://forum.ansible.com/u/Brad2)\ **Post date:** [October 3, 2018, 12:30pm UTC](https://forum.ansible.com/t/unable-to-remove-user-accounts-from-cisco-switches-running-ios-12-x-with-ansible-module-ios-user/28704/4 "2018-10-03T12:30:00Z")
Hi Andy, Understandable. Can you accomplish your task using shell or command module? Maybe use the expect module to switch to enable mode, then shell or command from there to achieve your task? Regards, Brad ---
**Author:** ![andrew.lemin](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@andrew.lemin](https://forum.ansible.com/u/andrew.lemin)\ **Post date:** [October 3, 2018, 3:20pm UTC](https://forum.ansible.com/t/unable-to-remove-user-accounts-from-cisco-switches-running-ios-12-x-with-ansible-module-ios-user/28704/5 "2018-10-03T15:20:33Z")
Hi Brad, Thanks for the reply. Good reminder about the ‘shell’ method… However I am trying to be strict about code quality and where complex logic resides. For example Ansible is a nice clean framework, for automating complex but repeatable actions/logic. The ‘shell’ method however would be breaking this rule by bringing complexity into the playbook. As such I think I would prefer to write a custom module and keep the playbooks elegant and clean so it’s readable and usable by NOC staff etc. That requires extra work, but would still be preferred as a last resort. I am actually new to Cisco automation with Ansible, my experience has been with JunOS which has been a dream compared, due to the JunOS CLI structure being a data model in itself and so being able to do most, if not all within jinja2 and lookups. As a result I came to the conclusion that ios\_command is for running show commands at ‘exec’ mode. And ios\_config is for running configuration commands within the ‘configure terminal’ level. So are you saying it’s possible to use the expect module with ‘ios\_command’, to get ios\_command to run stuff at the configure terminal level? Any examples you know of. If yes that sounds like the cleanest short term workaround to just run a config command which requires prompt handling 🙂 Thanks again, Andy. ---
**Author:** ![Brad2](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@Brad2](https://forum.ansible.com/u/Brad2)\ **Post date:** [October 3, 2018, 4:10pm UTC](https://forum.ansible.com/t/unable-to-remove-user-accounts-from-cisco-switches-running-ios-12-x-with-ansible-module-ios-user/28704/6 "2018-10-03T16:10:16Z")
No, darn it. I forgot those modules expect python on the target. So, expect, command, shell, etc won’t work. I think what you want to do is something like (I don’t have any way to test this at the moment): ---
**Author:** ![andrew.lemin](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@andrew.lemin](https://forum.ansible.com/u/andrew.lemin)\ **Post date:** [October 3, 2018, 5:30pm UTC](https://forum.ansible.com/t/unable-to-remove-user-accounts-from-cisco-switches-running-ios-12-x-with-ansible-module-ios-user/28704/7 "2018-10-03T17:30:29Z")
Ahhh, yea… The provider is network\_cli, so paramilko… I miss NETCONF 😉 You’ve just spun another ios\_\* module assumption I had around 🙂 I was under the impression that each ‘- name:’ definition was bounded with ios\_. And so a subsequent ‘- name:’ stanzas would go back to their root again, and thus you couldn’t chain commands to elevate the CLI levels like your example. Let me test. You’ve given me lots of ideas on how I can do this cleanly, as I want the IOS 12 workarounds to be the exceptions… Thanks Brad.