# win\_domain\_group\_membership

**URL:** <https://forum.ansible.com/t/win-domain-group-membership/32190>\
**Category:** Ansible Project\
**Created:** [February 10, 2020, 5:57pm UTC](https://forum.ansible.com/t/win-domain-group-membership/32190 "2020-02-10T17:57:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kzersatz](https://avatars.discourse-cdn.com/v4/letter/k/7bcc69/32.png) [@kzersatz](https://forum.ansible.com/u/kzersatz)\
**Post date:** [February 10, 2020, 5:57pm UTC](https://forum.ansible.com/t/win-domain-group-membership/32190/1 "2020-02-10T17:57:36Z")

</div>

Hey Folks,

I’ve got a couple of specific questions about win\_domain\_group\_membership.

I can find where support was backported to 2.8, and where its listed as supported in 2.9 (same post: [https://github.com/ansible/ansible/issues/59829](https://github.com/ansible/ansible/issues/59829))  
But I can’t for the life of me figure out how to convince Ansible do to the thing.

The thing being, take Group A from domain 1 and nest it within Group B from domain 2.

`  
##CROSS DOMAIN BS.

- name: H - Nest R Global in H univeral RW  
win\_domain\_group\_membership:  
domain\_server: “{{ h\_domain\_server }}”  
domain\_username: “{{ h\_domain\_username }}”  
domain\_password: “{{ h\_domain\_password }}”  
name: “{{ h\_u\_prefix }}{{ u\_name }}{{suffix\_RW}}”  
members:

- “{{ r\_g\_prefix }}{{ g\_name }}{{suffix\_RW}}@domain.dev”

- name: H - Nest R Global in H univeral RO  
win\_domain\_group\_membership:  
domain\_server: “{{ h\_domain\_server }}”  
domain\_username: “{{ h\_domain\_username }}”  
domain\_password: “{{ h\_domain\_password }}”  
name: “{{ h\_g\_prefix }}{{ g\_name }}{{suffix\_RO}}”  
members:

- “{{ r\_g\_prefix }}{{ g\_name }}{{suffix\_RO}}@domain.dev”

`

Note; for members: I’ve tried numerous ways of indicating that the group its to add is in another domain… domain\group, group@domain, or just group, and all bomb out stating that it cannot be found  
`

fatal: [ansible01.DOMAIN.DEV]: FAILED! =\> {  
“added”: ,  
“changed”: false,  
“msg”: “Could not find domain user, group, service account or computer named devdomain\GGRFStesting123RW”,  
“removed”:   
}

`

Is there an obvious mistake I’m making?  
I’m using ansible 2.9.2 currently.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [February 10, 2020, 7:03pm UTC](https://forum.ansible.com/t/win-domain-group-membership/32190/2 "2020-02-10T19:03:12Z")

</div>

Looks like I jumped the gun with closing that issue, the backported issue referenced is for a separate problem. The actual cross domain support of groups is still not supported in the module. There is a PR which you can try out [https://github.com/ansible/ansible/pull/65138](https://github.com/ansible/ansible/pull/65138) and comment on if it solves your issue.

---

<div class="post-metadata">

**Author:** ![kzersatz](https://avatars.discourse-cdn.com/v4/letter/k/7bcc69/32.png) [@kzersatz](https://forum.ansible.com/u/kzersatz)\
**Post date:** [February 10, 2020, 9:22pm UTC](https://forum.ansible.com/t/win-domain-group-membership/32190/3 "2020-02-10T21:22:49Z")

</div>

My bad on linking to the wrong issue 🙂

I’ve pulled it down and am giving it a shot now, will have results and comment on the PR if successful… so far I’m fighting the woes of a stripped down dev domain.

Thanks again Jordan.

---

<div class="post-metadata">

**Author:** ![kzersatz](https://avatars.discourse-cdn.com/v4/letter/k/7bcc69/32.png) [@kzersatz](https://forum.ansible.com/u/kzersatz)\
**Post date:** [February 10, 2020, 9:28pm UTC](https://forum.ansible.com/t/win-domain-group-membership/32190/4 "2020-02-10T21:28:05Z")

</div>

`  
The full traceback is:  
Could not add member(s) to one or more ADGroup.  
At line:82 char:9

- Add-ADPrincipalGroupMembership -Identity $group\_member -Membe …
- 

```auto

```

- CategoryInfo : OperationStopped: (Microsoft.Activ…ement.ADGroup:ADGroup) [Add-ADPrincipalGroupMembership], ADException
- FullyQualifiedErrorId : 1,Microsoft.ActiveDirectory.Management.Commands.AddADPrincipalGroupMembership

ScriptStackTrace:  
at , : line 82

Microsoft.ActiveDirectory.Management.ADException: Could not add member(s) to one or more ADGroup.  
at System.Management.Automation.MshCommandRuntime.ThrowTerminatingError(ErrorRecord errorRecord)  
fatal: [ansible01.domain.DEV]: FAILED! =\> {  
“changed”: false,  
“msg”: “Unhandled exception while executing module: Could not add member(s) to one or more ADGroup.”  
}

`

---

<div class="post-metadata">

**Author:** ![kzersatz](https://avatars.discourse-cdn.com/v4/letter/k/7bcc69/32.png) [@kzersatz](https://forum.ansible.com/u/kzersatz)\
**Post date:** [February 11, 2020, 5:50pm UTC](https://forum.ansible.com/t/win-domain-group-membership/32190/5 "2020-02-11T17:50:50Z")

</div>

I fixed it from the above error, PEBKAC.  
Updated the PR 🙂