win_domain_user created account could not be enabled

[derhoeppi]

SUMMARY

Running win_domain_user to create a new account failed, becaus of password policy violation. Running this job next time will not enable this accout although the passwor is valid and does not violate the policy.

ISSUE TYPE

• Bug Report

COMPONENT NAME

community.windows.win_domain_user

ANSIBLE VERSION

2.11.4

COLLECTION VERSION

community.windows             1.6.0

CONFIGURATION

nothing changed

OS / ENVIRONMENT

Ubuntu 20.04 as ansible controller and also produceable with AWX 19.3.0

STEPS TO REPRODUCE

- community.windows.win_domain_user:
        name: Bob
        password: 123
        upn: Bob@mydomain
        state: present
        update_password: when_changed
        password_never_expires: true
        account_locked: no
        enabled: yes

Rerun this step with a valid password

- community.windows.win_domain_user:
        name: Bob
        password: B0bP4ssw0rd#
        upn: Bob@mydomain
        state: present
        update_password: when_changed
        password_never_expires: true
        account_locked: no
        enabled: yes

EXPECTED RESULTS

The user should be created and enabled with the correct version of the password.

ACTUAL RESULTS

The user account was created during first run. Because of an empty passsword it is disabled. That's okay for security reason. At the second i get the following message:

FAILED! => {"changed": false, "msg": "Unhandled exception while executing module: Failed to logon Bob@mydomain (This user can't sign in because this account is currently disabled, Win32ErrorCode 1331 - 0x00000533)"

It works if i change the parameter "update_password" from when_changed to always. But next run i will only change this password if it was really different. So i have not chance to enable an user account.

[jborean93]

Looks like

community.windows/plugins/modules/win_domain_user.ps1

Lines 30 to 40 in a59b68e

	$success_codes = @(
	0x0000052F, # ERROR_ACCOUNT_RESTRICTION
	0x00000530, # ERROR_INVALID_LOGON_HOURS
	0x00000531, # ERROR_INVALID_WORKSTATION
	0x00000569 # ERROR_LOGON_TYPE_GRANTED
	)
	$failed_codes = @(
	0x0000052E, # ERROR_LOGON_FAILURE
	0x00000532, # ERROR_PASSWORD_EXPIRED
	0x00000773 # ERROR_PASSWORD_MUST_CHANGE
	)

needs to be updated to include 0x00000533 ERROR_ACCOUNT_DISABLED as one of the failure (maybe success?) codes. I'm honestly not sure what this error should really be when it comes to determining if the credential is valid or not but currently it's treated as a failure stopping the whole module.