# win\_domain\_user fails with unexpected error

**URL:** <https://forum.ansible.com/t/win-domain-user-fails-with-unexpected-error/30650>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [June 25, 2019, 6:13pm UTC](https://forum.ansible.com/t/win-domain-user-fails-with-unexpected-error/30650 "2019-06-25T18:13:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![IA1](https://avatars.discourse-cdn.com/v4/letter/i/6bbea6/32.png) [@IA1](https://forum.ansible.com/u/IA1)\
**Post date:** [June 25, 2019, 6:13pm UTC](https://forum.ansible.com/t/win-domain-user-fails-with-unexpected-error/30650/1 "2019-06-25T18:13:23Z")

</div>

I am currently working on automating the provisioning of the Active Directory servers in our environment. I have completed the majority of steps (Windows Features & Roles, Domain Creation, OUs, Groups, Group Memberships), but I have run into an issue with creating user accounts.

The following YAML code is what I am using to create a new user, and it is failing part way through. The user is created in AD, but does not have the group mappings (I have also tried different user / group combinations with no luck).

**create\_ansible\_user.yml**

- name: Create Ansible Domain User  
hosts: ADC\_Primary  
gather\_facts: yes  
tasks:

- name: “Create {{ domain\_admin\_user }} account”  
win\_domain\_user:  
name: ‘{{ domain\_admin\_name }}’  
firstname: ‘{{ domain\_admin\_name }}’  
surname: ‘{{ domain\_admin\_name }}’  
password: ‘{{ domain\_admin\_password }}’  
groups:

- Domain Users

- Domain Admins  
state: present

**all.yml**

ansible\_user: [administrator@MYDOMAIN.NET](mailto:administrator@MYDOMAIN.NET)  
ansible\_password: myPassword123!  
ansible\_connection: winrm  
ansible\_winrm\_transport: kerberos  
ansible\_port: 5986  
ansible\_winrm\_server\_cert\_validation: ignore

domain\_lower:  
prefix: mydomain  
suffix: net

domain\_admin\_name: s\_ansible  
domain\_admin\_user: ‘{{ domain\_admin\_name }}@{{ domain\_lower.prefix }}.{{ domain\_lower.suffix }}’  
domain\_admin\_password: myPassw0rd123!

**hosts**

**[ADC\_Primary]**  
**[PRIASADC01.MYDOMAIN.NET](http://PRIASADC01.MYDOMAIN.NET)**

**Output**

TASK [Create [s\_ansible@mydomain.net](mailto:s_ansible@mydomain.net) account] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
fatal: [[PRIASADC01.MYDOMAIN.NET](http://PRIASADC01.MYDOMAIN.NET)]: FAILED! =\> {“changed”: true, “msg”: “An unspecified error has occurred”, “password\_updated”: true}

As you can see, the module throws an unspecified error. The user itself is actually created, but does not have any group mappings apart from Domain Users.

Is there any way to get a stacktrace or more details? Verbose did not seem to add anything.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [June 25, 2019, 7:32pm UTC](https://forum.ansible.com/t/win-domain-user-fails-with-unexpected-error/30650/2 "2019-06-25T19:32:37Z")

</div>

Unfortunately no, I had a look at the code and it still used the old way of working which was to wrap exceptions at the top level and this unfortunately hid things from view. I’ve raised a PR to remove this behaviour so that on a failure it will show the proper error message and stacktrace when you run with -vvv [https://github.com/ansible/ansible/pull/58357](https://github.com/ansible/ansible/pull/58357).

The actual error is being returned by a cmdlet so it’s unfortunate it doesn’t return something useful but once we find out what cmdlet is failing that should help. Looking at your code I can’t really see what it may be. The code that manages the groups can be found at [https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win\_domain\_user.ps1#L211-L259](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win_domain_user.ps1#L211-L259) so it might be a good idea to run it manually and see if it fails.

Thanks

Jordan