win_user module and GPO settings

Archives Ansible Project
1

Tower 2.4.5

Trying to have the win_user module set built-in admin and guest account to disabled.

Guest account is not taking due to some fairly standard GPO settings.

  1. Access this PC from network has default “everyone” removed
  2. Deny access to this computer from the network has custom entry of “guests” group.

the stdout fails “exception calling "ValidateCredentials" with "2” arguments(s): "Logon failure: the user has not been granted the requested logon type at this computer. \r\n"

adding Guests group to option 1 and removing from option 2 allows Ansible/Tower to push the setting successfully.

Sounds like however the ps1 file makes the call (which would be local right?) its needing that network access to do so.

2

We could probably short-circuit the credential validation on disable, but you’d have the same issue if you tried to re-enable that account. Please file a GitHub issue on win_user in
https://github.com/ansible/ansible-modules-core/ with the details…