# win\_user module and GPO settings

**URL:** <https://forum.ansible.com/t/win-user-module-and-gpo-settings/22310>\
**Category:** Ansible Project\
**Created:** [August 17, 2016, 8:01pm UTC](https://forum.ansible.com/t/win-user-module-and-gpo-settings/22310 "2016-08-17T20:01:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![cupcake](https://avatars.discourse-cdn.com/v4/letter/c/d6d6ee/32.png) [@cupcake](https://forum.ansible.com/u/cupcake)\
**Post date:** [August 17, 2016, 8:01pm UTC](https://forum.ansible.com/t/win-user-module-and-gpo-settings/22310/1 "2016-08-17T20:01:31Z")

</div>

Tower 2.4.5

Trying to have the win\_user module set built-in admin and guest account to disabled.

Guest account is not taking due to some fairly standard GPO settings.

1. Access this PC from network has default “everyone” removed
2. Deny access to this computer from the network has custom entry of “guests” group.

the stdout fails “exception calling "ValidateCredentials" with "2” arguments(s): "Logon failure: the user has not been granted the requested logon type at this computer. \r\n"

adding Guests group to option 1 and removing from option 2 allows Ansible/Tower to push the setting successfully.

Sounds like however the ps1 file makes the call (which would be local right?) its needing that network access to do so.

---

<div class="post-metadata">

**Author:** ![Matt\_Davis](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Matt\_Davis](https://forum.ansible.com/u/Matt_Davis)\
**Post date:** [August 18, 2016, 8:36pm UTC](https://forum.ansible.com/t/win-user-module-and-gpo-settings/22310/2 "2016-08-18T20:36:19Z")

</div>

We could probably short-circuit the credential validation on disable, but you’d have the same issue if you tried to re-enable that account. Please file a GitHub issue on win\_user in  
[https://github.com/ansible/ansible-modules-core/](https://github.com/ansible/ansible-modules-core/) with the details…