# win\_domain\_user and tree traversing

**URL:** <https://forum.ansible.com/t/win-domain-user-and-tree-traversing/29408>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [January 9, 2019, 4:43pm UTC](https://forum.ansible.com/t/win-domain-user-and-tree-traversing/29408 "2019-01-09T16:43:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Harmon](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@John\_Harmon](https://forum.ansible.com/u/John_Harmon)\
**Post date:** [January 9, 2019, 4:43pm UTC](https://forum.ansible.com/t/win-domain-user-and-tree-traversing/29408/1 "2019-01-09T16:43:26Z")

</div>

I have two AD trees. One is a flat, test system–no frills. Users reside in the default windows container (CN=Users under the DC). The other is our production system, which has users all over the place. I am able to query the test system for users, but not the production system.

Does win\_domain\_user only work with CN=Users at the root of the tree (ie. CN=Users,DC=mytest,DC=local)?

If so, is there a way to specify another DN? I haven’t been able to find one (for queries at least).

debug:

`

---

<div class="post-metadata">

**Author:** ![John\_Harmon](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@John\_Harmon](https://forum.ansible.com/u/John_Harmon)\
**Post date:** [January 9, 2019, 4:45pm UTC](https://forum.ansible.com/t/win-domain-user-and-tree-traversing/29408/2 "2019-01-09T16:45:21Z")

</div>

My query:

`  
tasks:

- name: Windows AD Testing  
win\_domain\_user:  
name: “{{ user }}”  
state: query  
register: username

- debug:  
var: username

`

---

<div class="post-metadata">

**Author:** ![John\_Harmon](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@John\_Harmon](https://forum.ansible.com/u/John_Harmon)\
**Post date:** [January 9, 2019, 5:13pm UTC](https://forum.ansible.com/t/win-domain-user-and-tree-traversing/29408/3 "2019-01-09T17:13:28Z")

</div>

Hmmmm… this might be a credssp issue. Let me work on that for a while and get back to this.

---

<div class="post-metadata">

**Author:** ![John\_Harmon](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@John\_Harmon](https://forum.ansible.com/u/John_Harmon)\
**Post date:** [January 9, 2019, 11:08pm UTC](https://forum.ansible.com/t/win-domain-user-and-tree-traversing/29408/4 "2019-01-09T23:08:21Z")

</div>

OK, it was an issue with credssp, but RHEL seems to have issues installing all of the necessary packages when on the latest code.

I am on 7.6 with pip 18.1. I had to downgrade pip in order to install credssp:  
pip install --upgrade --force-reinstall pip==9.0.3

After that I upgraded pip again to 18.1

Seems to be working now. I have a ticket filed with RedHat to see if this can be fixed so we don’t have to jump through a lot of hoops to get it working on the latest code.