Fixing LAPS Deployment Error in GOAD (Ansible)

[YaserHZ]

🔧 Fixing LAPS Deployment Error in GOAD (Ansible)

🧩 Overview

While deploying Microsoft LAPS (Local Administrator Password Solution) using Ansible in the GOAD (Game of Active Directory) lab, the playbook may fail during the schema modification phase.

This issue occurs when attempting to add LAPS attributes to the Computer class in Active Directory.

---

❌ Error Output

The playbook fails at the following step:

TASK [laps/dc : Add LAPS attributes to the Computer Attribute on dc03]
FAILED - RETRYING: [dc03]: Add LAPS attributes to the Computer Attribute (3 retries left).
FAILED - RETRYING: [dc03]: Add LAPS attributes to the Computer Attribute (2 retries left).
FAILED - RETRYING: [dc03]: Add LAPS attributes to the Computer Attribute (1 retries left).

TASK [laps/dc : Add LAPS attributes to the Computer Attribute]
[ERROR]: Task failed: Module failed: Unhandled exception while executing module:
Invalid type 'System.Management.Automation.PSObject'.
Parameter name: mayContain

Origin: /home/kali/Desktop/GOAD/ansible/roles/laps/dc/tasks/install.yml:78:3

fatal: [dc03]: FAILED! => {
  "attempts": 3,
  "changed": false,
  "msg": "Unhandled exception while executing module:
  Invalid type 'System.Management.Automation.PSObject'.
  Parameter name: mayContain"
}

PLAY RECAP
dc03 : ok=7 changed=1 failed=1

---

📍 Affected File and Code Location

The issue originates from the following file:

/home/kali/Desktop/GOAD/ansible/roles/laps/dc/tasks/install.yml

🔎 Problematic Section (Around Line 78)

- name: Add LAPS attributes to the Computer Attribute
  win_ad_object:
    name: Computer
    may_contain:
      - ms-Mcs-AdmPwd
      - ms-Mcs-AdmPwdExpirationTime
    context: schema
    update_schema: True

---

🎯 Root Cause

The problem is caused by incorrect usage of the may_contain parameter in the win_ad_object module.

❌ Incorrect Usage

may_contain:
  - ms-Mcs-AdmPwd
  - ms-Mcs-AdmPwdExpirationTime

• The parameter is passed as a list
• Ansible converts it into a PowerShell PSObject
• The module expects a string, not a list
• This results in a type mismatch and failure

---

✅ Solution

To resolve the issue, split the task into two separate tasks, each adding one attribute at a time.

✔️ Fixed Configuration

- name: Add ms-Mcs-AdmPwd to Computer class
  win_ad_object:
    name: Computer
    may_contain: ms-Mcs-AdmPwd
    context: schema
    update_schema: True
  register: add_laps_attribute_pwd
  until: add_laps_attribute_pwd is not failed
  retries: 3
  delay: 120
  become: yes
  become_method: runas
  become_user: SYSTEM

- name: Add ms-Mcs-AdmPwdExpirationTime to Computer class
  win_ad_object:
    name: Computer
    may_contain: ms-Mcs-AdmPwdExpirationTime
    context: schema
    update_schema: True
  register: add_laps_attribute_exp
  until: add_laps_attribute_exp is not failed
  retries: 3
  delay: 120
  become: yes
  become_method: runas
  become_user: SYSTEM

---

🔁 Re-running the Playbook

After applying the fix, navigate to the Ansible directory and re-run the playbook:

cd ~/Desktop/GOAD/ansible

ansible-playbook -i ../ad/GOAD/data/inventory \
                 -i ../ad/GOAD/providers/vmware/inventory \
                 laps.yml --limit dc03