# Test code for win_group_membership
# Copyright: (c) 2017, Andrew Saraceni <andrew.saraceni@gmail.com>
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
- name : Look up built-in Administrator account name (-500 user whose domain == computer name)
raw : $machine_sid = (Get-CimInstance Win32_UserAccount -Filter "Domain='$env:COMPUTERNAME'")[0].SID -replace '(S-1-5-21-\d+-\d+-\d+)-\d+', '$1'; (Get-CimInstance Win32_UserAccount -Filter "SID='$machine_sid-500'").Name
check_mode : no
register : admin_account_result
- set_fact :
admin_account_name : "{{ admin_account_result.stdout_lines[0] }}"
- name : Remove potentially leftover group members
win_group_membership :
name : "{{ win_local_group }}"
members :
- "{{ admin_account_name }}"
- "{{ win_local_user }}"
- NT AUTHORITY\SYSTEM
- NT AUTHORITY\NETWORK SERVICE
state : absent
- name : Add user to fake group
win_group_membership :
name : FakeGroup
members :
- "{{ admin_account_name }}"
state : present
register : add_user_to_fake_group
failed_when : add_user_to_fake_group.changed != false or add_user_to_fake_group.msg != "Could not find local group FakeGroup"
- name : Add fake local user
win_group_membership :
name : "{{ win_local_group }}"
members :
- FakeUser
state : present
register : add_fake_local_user
failed_when : add_fake_local_user.changed != false or add_fake_local_user.msg is not search("account_name FakeUser is not a valid account, cannot get SID.*")
- name : Add users to group
win_group_membership : &wgm_present
name : "{{ win_local_group }}"
members :
- "{{ admin_account_name }}"
- "{{ win_local_user }}"
- NT AUTHORITY\SYSTEM
state : present
register : add_users_to_group
- name : Test add_users_to_group (normal mode)
assert :
that :
- add_users_to_group.changed == true
- add_users_to_group.added == ["{{ ansible_hostname }}\\{{ admin_account_name }}", "{{ ansible_hostname }}\\{{ win_local_user }}", "NT AUTHORITY\\SYSTEM"]
- add_users_to_group.members == ["{{ ansible_hostname }}\\{{ admin_account_name }}", "{{ ansible_hostname }}\\{{ win_local_user }}", "NT AUTHORITY\\SYSTEM"]
when : not in_check_mode
- name : Test add_users_to_group (check-mode)
assert :
that :
- add_users_to_group.changed == true
- add_users_to_group.added == []
- add_users_to_group.members == []
when : in_check_mode
- name : Add users to group (again)
win_group_membership : *wgm_present
register : add_users_to_group_again
- name : Test add_users_to_group_again (normal mode)
assert :
that :
- add_users_to_group_again.changed == false
- add_users_to_group_again.added == []
- add_users_to_group_again.members == ["{{ ansible_hostname }}\\{{ admin_account_name }}", "{{ ansible_hostname }}\\{{ win_local_user }}", "NT AUTHORITY\\SYSTEM"]
when : not in_check_mode
- name : Add different syntax users to group (again)
win_group_membership :
<< : *wgm_present
members :
- '{{ ansible_hostname }}\{{ admin_account_name }}'
- '.\{{ win_local_user }}'
register : add_different_syntax_users_to_group_again
- name : Test add_different_syntax_users_to_group_again (normal mode)
assert :
that :
- add_different_syntax_users_to_group_again.changed == false
- add_different_syntax_users_to_group_again.added == []
- add_different_syntax_users_to_group_again.members == ["{{ ansible_hostname }}\\{{ admin_account_name }}", "{{ ansible_hostname }}\\{{ win_local_user }}", "NT AUTHORITY\\SYSTEM"]
when : not in_check_mode
- name : Test add_different_syntax_users_to_group_again (check-mode)
assert :
that :
- add_different_syntax_users_to_group_again.changed == true
- add_different_syntax_users_to_group_again.added == []
- add_different_syntax_users_to_group_again.members == []
when : in_check_mode
- name : Add another user to group
win_group_membership : &wgma_present
<< : *wgm_present
members :
- NT AUTHORITY\NETWORK SERVICE
register : add_another_user_to_group
- name : Test add_another_user_to_group (normal mode)
assert :
that :
- add_another_user_to_group.changed == true
- add_another_user_to_group.added == ["NT AUTHORITY\\NETWORK SERVICE"]
- add_another_user_to_group.members == ["{{ ansible_hostname }}\\{{ admin_account_name }}", "{{ ansible_hostname }}\\{{ win_local_user }}", "NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK SERVICE"]
when : not in_check_mode
- name : Test add_another_user_to_group (check-mode)
assert :
that :
- add_another_user_to_group.changed == true
- add_another_user_to_group.added == []
- add_another_user_to_group.members == []
when : in_check_mode
- name : Add another user to group (again)
win_group_membership : *wgma_present
register : add_another_user_to_group_again
- name : Test add_another_user_to_group_1_again (normal mode)
assert :
that :
- add_another_user_to_group_again.changed == false
- add_another_user_to_group_again.added == []
- add_another_user_to_group_again.members == ["{{ ansible_hostname }}\\{{ admin_account_name }}", "{{ ansible_hostname }}\\{{ win_local_user }}", "NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK SERVICE"]
when : not in_check_mode
- name : Remove users from group
win_group_membership : &wgm_absent
<< : *wgm_present
state : absent
register : remove_users_from_group
- name : Test remove_users_from_group (normal mode)
assert :
that :
- remove_users_from_group.changed == true
- remove_users_from_group.removed == ["{{ ansible_hostname }}\\{{ admin_account_name }}", "{{ ansible_hostname }}\\{{ win_local_user }}", "NT AUTHORITY\\SYSTEM"]
- remove_users_from_group.members == ["NT AUTHORITY\\NETWORK SERVICE"]
when : not in_check_mode
- name : Test remove_users_from_group (check-mode)
assert :
that :
- remove_users_from_group.changed == false
- remove_users_from_group.removed == []
- remove_users_from_group.members == []
when : in_check_mode
- name : Remove users from group (again)
win_group_membership : *wgm_absent
register : remove_users_from_group_again
- name : Test remove_users_from_group_again (normal mode)
assert :
that :
- remove_users_from_group_again.changed == false
- remove_users_from_group_again.removed == []
- remove_users_from_group_again.members == ["NT AUTHORITY\\NETWORK SERVICE"]
when : not in_check_mode
- name : Remove different syntax users from group (again)
win_group_membership :
<< : *wgm_absent
members :
- '{{ ansible_hostname }}\{{ admin_account_name }}'
- '.\{{ win_local_user }}'
register : remove_different_syntax_users_from_group_again
- name : Test remove_different_syntax_users_from_group_again (normal mode)
assert :
that :
- remove_different_syntax_users_from_group_again.changed == false
- remove_different_syntax_users_from_group_again.removed == []
- remove_different_syntax_users_from_group_again.members == ["NT AUTHORITY\\NETWORK SERVICE"]
when : not in_check_mode
- name : Test add_different_syntax_users_to_group_again (check-mode)
assert :
that :
- remove_different_syntax_users_from_group_again.changed == false
- remove_different_syntax_users_from_group_again.removed == []
- remove_different_syntax_users_from_group_again.members == []
when : in_check_mode
- name : Remove another user from group
win_group_membership : &wgma_absent
<< : *wgm_absent
members :
- NT AUTHORITY\NETWORK SERVICE
register : remove_another_user_from_group
- name : Test remove_another_user_from_group (normal mode)
assert :
that :
- remove_another_user_from_group.changed == true
- remove_another_user_from_group.removed == ["NT AUTHORITY\\NETWORK SERVICE"]
- remove_another_user_from_group.members == []
when : not in_check_mode
- name : Test remove_another_user_from_group (check-mode)
assert :
that :
- remove_another_user_from_group.changed == false
- remove_another_user_from_group.removed == []
- remove_another_user_from_group.members == []
when : in_check_mode
- name : Remove another user from group (again)
win_group_membership : *wgma_absent
register : remove_another_user_from_group_again
- name : Test remove_another_user_from_group_again (normal mode)
assert :
that :
- remove_another_user_from_group_again.changed == false
- remove_another_user_from_group_again.removed == []
- remove_another_user_from_group_again.members == []
when : not in_check_mode
