"changed": false, "distinguished_name": null, "msg": "New-ADUser failed: The specified account already exists", "object_guid": null

[ba31]

SUMMARY

Unable to set password/change password of the user that already exist in domain.password can only be set at the time of user creation otherwise its generate error "Unable to set password expired to at the time user creation. password_expired can only be set once user is created. otherwise its generate error "FAILED! => {"changed": false, "distinguished_name": null, "msg": "New-ADUser failed: The specified account already exists", "object_guid": null}"

ISSUE TYPE

FAILED! => {"changed": false, "distinguished_name": null, "msg": "New-ADUser failed: The specified account already exists", "object_guid": null}

COMPONENT NAME

microsoft.ad.user

ANSIBLE VERSION

ansible [core 2.15.0]
  config file = None
  configured module search path = ['/home/demo/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/demo/.pyenv/versions/3.11.3/lib/python3.11/site-packages/ansible
  ansible collection location = /home/demo/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/demo/.pyenv/versions/3.11.3/bin/ansible
  python version = 3.11.3 (main, Jun  2 2023, 11:09:30) [GCC 11.3.0] (/home/demo/.pyenv/versions/3.11.3/bin/python3)
  jinja version = 3.1.2
  libyaml = True

COLLECTION VERSION

Collection        Version
----------------- -------
community.general 6.6.0

CONFIGURATION

    - name: prepare user for login
      microsoft.ad.user:
        name: test.pass
        password: password
        password_expired: true
       account_locked: false

OS / ENVIRONMENT

Linux  5.10.102.1-microsoft-standard-WSL2 #1 SMP Wed Mar 2 00:30:59 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

STEPS TO REPRODUCE

    - name: prepare user for login
      microsoft.ad.user:
        name: test.pass
        password: password
        password_expired: true
       account_locked: false

ansible-playbook -i hosts microsoft.ad.user.yaml

EXPECTED RESULTS

The account password should be reset

ACTUAL RESULTS

[jborean93]

Keep in mind that name is not the sAMAccountName it is the name of the LDAP user entry in the path specified (which defaults to whatever your AD is configured with). There is a request to allow using only the identity parameter without name to lookup the user by sAMAccountName rather than by the name and optional path that's currently needed.

[jborean93]

I have opened a draft PR #75 that implements the behaviour. I'll have to add more tests for this scenario before I merge it in though.