# variables question

**URL:** <https://forum.ansible.com/t/variables-question/27877>\
**Category:** Ansible Project\
**Created:** [June 27, 2018, 12:21am UTC](https://forum.ansible.com/t/variables-question/27877 "2018-06-27T00:21:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![AJS](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@AJS](https://forum.ansible.com/u/AJS)\
**Post date:** [June 27, 2018, 12:21am UTC](https://forum.ansible.com/t/variables-question/27877/1 "2018-06-27T00:21:33Z")

</div>

What is the proper way for me to leave certain variables blank within a play? Right now if I run i get errors back because all variables are not used in each array. The first 2 permission\_vars are directly from the win\_acl documentation page.

[https://docs.ansible.com/ansible/latest/modules/win\_acl\_module.html#win-acl-module](https://docs.ansible.com/ansible/latest/modules/win_acl_module.html#win-acl-module)

- name: Restrict write and execute access to user  
win\_acl:  
user: “{{ item.user }}”  
path: “{{ item.user }}”  
type: “{{ item.type }}”  
rights: “{{ item.rights }}”  
state: “{{ item.state }}”  
inherit: “{{ item.inherit }}”  
propagation: “{{ item.propagation }}”  
with\_items:
- “{{ permission\_vars }}”

permission\_vars:

- { user: ‘Fed-Phil’, path: ‘C:\Important\Executable.exe’, type: ‘deny’, rights: ‘ExecuteFile,Write’}
- { user: ‘BUILTIN\Users’, path: ‘HKCU:\Bovine\Key’, type: ‘allow’, rights: ‘EnumerateSubKeys’, state: ‘present’, inherit: ‘Container, ObjInherit’, propagation: ‘none’}

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [June 27, 2018, 1:29am UTC](https://forum.ansible.com/t/variables-question/27877/2 "2018-06-27T01:29:25Z")

</div>

You want to use the default[1] filter combined with omit[2], e.g.

`

- win\_acl:  
user: “{{ item.user }}”  
path: “{{ item.path }}”  
type: “{{ item.type }}”  
rights: “{{ item.rights }}”  
state: “{{ item.state|default(‘present’) }}”  
inherit: “{{ item.inherit|default(omit) }}”  
propagation: “{{ item.propagation|default(omit) }}”  
with\_items:
- user: Fed-Phil  
path: C:\Important\Executable.exe  
type: deny  
rights: ExecuteFile,Write
- user: BUILTIN\Users  
path: HKCU:\Bovine\Key  
type: allow  
rights: EnumerateSubKeys  
state: present  
inherit: Container, ObjInherit  
propagation: ‘none’  
`

Here’s what the above means

- state will use the item value if defined otherwise will use ‘present’
- inherit and propagation will use the item value if defined otherwise will be set to omit

What omit does is to not pass any value to the module, similar to not specifying that option manually.

Thanks

Jordan

[1] [https://docs.ansible.com/ansible/latest/user\_guide/playbooks\_filters.html#defaulting-undefined-variables](https://docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html#defaulting-undefined-variables)  
[2] [https://docs.ansible.com/ansible/latest/user\_guide/playbooks\_filters.html#omitting-parameters](https://docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html#omitting-parameters)

---

<div class="post-metadata">

**Author:** ![AJS](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@AJS](https://forum.ansible.com/u/AJS)\
**Post date:** [June 27, 2018, 12:14pm UTC](https://forum.ansible.com/t/variables-question/27877/3 "2018-06-27T12:14:00Z")

</div>

Thank you Jordan