Active Directory Domain Management with Ansible

Lab Guide - Scenario 02: Standardized Consistency (Continued)

1. Introduction

Excellent work on the initial deployment! However, as often happens in IT operations, requirements have evolved. You’ve received an updated ticket that builds upon your existing infrastructure.

Updated Support Ticket #003

Now that you have a functioning domain, Windows systems, and a new RHEL system deployed, it’s time to complete the environment setup by managing user accounts, organizational units, and domain membership across your hybrid infrastructure.

1.1. Learning Objectives

By the end of this lab, you will be able to:

  • Create and manage Active Directory organizational units and security groups

  • Automate user account creation with appropriate group memberships

  • Join both Windows and Linux systems to Active Directory domains

  • Implement survey-driven automation for dynamic configuration input

2. Lab Environment Setup

Your DNS domain for this lab is: {dns_domain}

This lab builds upon the infrastructure deployed in the previous scenario. Ensure your domain controller and initial systems are properly configured before proceeding.

3. Exercise 1: Creating Organizational Units and User Accounts

Active Directory requires proper organizational structure to manage users and resources effectively. You’ll create the necessary organizational units and groups for your development teams.

3.1. Step 1: Deploy Active Directory Structure

  1. Navigate to Automation Execution → Templates

  2. Launch the Windows Users and OU template

This template may appear on page 2 of your template list, depending on your screen resolution.

3.2. Step 2: Configure Organizational Details

When prompted, provide the following configuration details:

Field Value

OU

Testing

Group

TMM-Dev

  1. Click Next and Finish to start the job

The automation will create the organizational structure and populate it with the necessary user accounts and groups for your development environment.

3.3. Step 3: Verify Active Directory Configuration

Once the job completes, verify the configuration on your domain controller:

  1. Navigate to the Windows tab

  2. Click the Start/Windows button

  3. Select Windows Administrative Tools → Active Directory Users and Computers

  4. Expand the domain structure

Confirm that the following have been successfully created: * Testing OU (Organizational Unit) * TMM-Dev group * Developer user accounts

Active Directory Structure - Accounts and OUs

4. Exercise 2: Domain Membership Management

With your Active Directory structure in place, you need to join both Windows and Linux systems to the domain for centralized management and authentication.

4.1. Windows Server Domain Join

4.1.1. Step 1: Join Windows Server to Domain

  1. Navigate back to your AAP tab

  2. Go to Automation Execution → Templates

  3. Launch the Windows Join Domain template

4.1.2. Step 2: Verify Windows Domain Membership

  1. Navigate to the Windows tab

  2. Click Start/Windows → Windows Administrative Tools → Active Directory Users and Computers

You should see your Windows server listed in the domain structure.

Windows Server Domain Membership

4.2. RHEL Server Domain Join

4.2.1. Step 1: Configure Survey for Domain Input

Your RHEL systems also need domain membership, but first you need to create a flexible survey to specify domain information:

  1. Navigate to Automation Execution → Templates

  2. Select the RHEL Join AD template

  3. Click on the Survey tab

Survey Configuration Interface

4.2.2. Step 2: Create Domain Survey Question

  1. Click Create survey question

  2. Configure the survey with the following details:

Survey Configuration:

Field Value

Question

Please provide the domain to join

Description

Domain/Forest information

Answer variable name

domain

  1. Click Create survey question

  2. Enable the survey using the toggle

Survey Enable Toggle

4.2.3. Step 3: Execute RHEL Domain Join

  1. Launch the template

  2. When prompted, provide your DNS domain information: {dns_domain}

RHEL Domain Join Input

  1. Click Next to proceed

4.2.4. Step 4: Verify Complete Domain Integration

After both Windows and RHEL domain joins complete:

  1. Navigate to the Windows tab

  2. Open Start/Windows → Windows Administrative Tools → Active Directory Users and Computers

  3. Verify that both systems appear in the domain

Domain Membership Verification

Having both Windows and RHEL systems in the same domain enables centralized authentication, policy management, and simplified administration across your hybrid infrastructure.

5. Code Reference

5.1. Active Directory User and Group Management

Here’s the automation code for creating organizational units, groups, and users:

tasks:
  - name: Create a group in an OU
    microsoft.ad.group:
      identity: "{{ group_name }}"
      scope: global
      path: "{{ ou_path }}"
      state: present

  - name: Create users for lab
    microsoft.ad.user:
      identity: "{{ item.key }}"
      password: "{{ user_password }}"
      firstname: "{{ item.value.firstname }}"
      surname: "{{ item.value.surname }}"
      state: present
      groups:
        set:
          - "{{ group_name }}"
          - Domain Users
    loop: "{{ users_list | dict2items }}"

  - name: Create Ansible Admin
    microsoft.ad.user:
      identity: "{{ admin_user }}"
      password: "{{ admin_password }}"
      firstname: "Ansible AD"
      surname: "Administrator"
      state: present
      groups:
        set:
          - Domain Admins
          - Domain Users

5.2. Domain Membership Management

Here’s the code for joining servers to the Active Directory domain:

tasks:
  - name: Join host to Domain
    microsoft.ad.membership:
      dns_domain_name: "{{ wins_domain }}"
      hostname: "{{ inventory_hostname }}"
      domain_admin_user: Administrator
      domain_admin_password: "{{ safe_password }}"
      domain_server: "{{ hostname_cleaned }}"
      state: domain
      reboot: true