Answers: <blockquote>
  <p><em>... mostly achieves the lock behavior, but it also creates the user. The <code>state</code> property only has possible values <code>present</code> and <code>absent</code> ...</em></p>
  </blockquote>
  <p>Right, that would be the best approach and expected behavior.</p>
  <blockquote>
  <p><em>One can obtain a fact on the user presence using <code>ansible.builtin.getent</code> and then conditionally use <code>ansible.builtin.user</code>.</em></p>
  </blockquote>
  <p>And also right, this would be too the recommended approach.</p>
  <p>In other words, currently there is no possibility to configure such within one single task and if not using <code>shell</code> module, custom scripts or custom modules.</p>
  <p><strong>Similar Q&amp;A</strong></p>
  <ul>
  <li><a href="https://serverfault.com/a/1035610/448950">Ansible, only disable existing users?</a></li>
  </ul>
  
Answers: CC BY-SA 4.0
Answers: 2022-12-02T17:10:25.470Z
Answers: 2022-12-02T17:10:25.470Z
Answers: U880D
Body: <p>Given a username, if that user exists, lock it, otherwise keep it missing.</p>
  <p>The most likely module is <code>ansible.builtin.user</code>. There passing <code>password: &quot;*&quot;</code> and <code>shell: &quot;/usr/sbin/nologin&quot;</code> mostly achieves the lock behavior, but it also creates the user. The <code>state</code> property only has possible values <code>present</code> and <code>absent</code>, neither of which describes the desired behavior.</p>
  <p>One can obtain a fact on the user presence using <code>ansible.builtin.getent</code> and then conditionally use <code>ansible.builtin.user</code>. Is there a better way?</p>
  
Tags: <ansible>
Title: How to lock a user using ansible?
UserDisplayName: Helmut Grohne
ThreadText: # How to lock a user using ansible?
  
  (Asked by: username_0 on 2022-12-02)
  
  Given a username, if that user exists, lock it, otherwise keep it missing.
  
  The most likely module is `ansible.builtin.user`. There passing `password: "*"` and `shell: "/usr/sbin/nologin"` mostly achieves the lock behavior, but it also creates the user. The `state` property only has possible values `present` and `absent`, neither of which describes the desired behavior.
  
  One can obtain a fact on the user presence using `ansible.builtin.getent` and then conditionally use `ansible.builtin.user`. Is there a better way?
  
  **Tags:** ansible
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2022-12-02. Score: 2 | Accepted answer
  
  > *... mostly achieves the lock behavior, but it also creates the user. The `state` property only has possible values `present` and `absent` ...*
  
  Right, that would be the best approach and expected behavior.
  
  > *One can obtain a fact on the user presence using `ansible.builtin.getent` and then conditionally use `ansible.builtin.user`.*
  
  And also right, this would be too the recommended approach.
  
  In other words, currently there is no possibility to configure such within one single task and if not using `shell` module, custom scripts or custom modules.
  
  **Similar Q&A**
  
  * [Ansible, only disable existing users?](https://serverfault.com/a/1035610/448950)
  
  
  ---
  
  