Azure/Ansible: improve idempotency (2)

Azure/Ansible/roles/dc/tasks/main.yml

@@ -1,7 +1,12 @@
 ---
 
 - name: Set DNS Address
-  win_shell: "Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 127.0.0.1,8.8.8.8"
+  win_dns_client:
+    adapter_names: '*'
+    ipv4_addresses:
+      - 127.0.0.1
+      - 8.8.8.8
+    log_path: C:\dns_log.txt
 
 - name: Install git
   win_chocolatey:
@@ -33,6 +38,8 @@
       - Users
       - Administrators
     password_never_expires: yes
+  # Fail after domain creation: Failed to remove Domain Users: Exception calling \"Remove\" with \"1\" argument(s): \"This operation is not allowed on this special group.
+  ignore_errors: true
   
 - name: Create the Domain
   win_shell: .\\provision.ps1
@@ -47,6 +54,7 @@
     pre_reboot_delay: 15
     reboot_timeout: 600
     post_reboot_delay: 60
+  when: domain_creation.changed
 
 - name: Configure OU
   win_shell: .\\configure-ou.ps1
@@ -60,6 +68,7 @@
     ansible_become_password: vagrant
     ansible_become_flags: logon_type=new_credentials logon_flags=netcredentials_only
   failed_when: "'Exception' in ou_creation.stderr"
+  changed_when: "'already exists. Moving On.' not in ou_creation.stdout"
 
 - debug: msg="{{ ou_creation.stdout_lines }}"
 
@@ -75,8 +84,10 @@
     ansible_become_password: vagrant
     ansible_become_flags: logon_type=new_credentials logon_flags=netcredentials_only
   failed_when: "'Exception' in wef_gpo.stderr"
+  changed_when: "' already linked on ' not in wef_gpo.stdout"
 
 - debug: msg="{{ wef_gpo.stdout_lines }}"
+  when: wef_gpo.stdout_lines is defined
 
 - name: Configure Powershell Logging GPO
   win_shell: .\\configure-powershelllogging.ps1
@@ -90,8 +101,10 @@
     ansible_become_password: vagrant
     ansible_become_flags: logon_type=new_credentials logon_flags=netcredentials_only
   failed_when: "'Exception' in powershell_gpo.stderr"
+  changed_when: "' already linked on ' not in wef_gpo.stdout"
 
 - debug: msg="{{ powershell_gpo.stdout_lines }}"
+  when: powershell_gpo.stdout_lines is defined
 
 - name: Configure Auditing Policy GPO
   win_shell: .\\configure-AuditingPolicyGPOs.ps1
@@ -105,8 +118,10 @@
     ansible_become_password: vagrant
     ansible_become_flags: logon_type=new_credentials logon_flags=netcredentials_only
   failed_when: "'Exception' in audit_policy.stderr"
+  changed_when: "' already linked on ' not in audit_policy.stdout"
 
 - debug: msg="{{ audit_policy.stdout_lines }}"
+  when: audit_policy.stdout_lines is defined
 
 - name: Disable Windows Defender GPO
   win_shell: .\\configure-disable-windows-defender-gpo.ps1
@@ -120,6 +135,7 @@
     ansible_become_password: vagrant
     ansible_become_flags: logon_type=new_credentials logon_flags=netcredentials_only
   failed_when: "'Exception' in disable_win_def.stderr"
+  changed_when: "' already linked at ' not in disable_win_def.stdout"
 
 - debug: msg="{{ disable_win_def.stdout_lines }}"
 
@@ -135,8 +151,10 @@
     ansible_become_password: vagrant
     ansible_become_flags: logon_type=new_credentials logon_flags=netcredentials_only
   failed_when: "'Exception' in rdp_gpo.stderr"
+  changed_when: "' already linked at ' not in rdp_gpo.stdout"
 
 - debug: msg="{{ rdp_gpo.stdout_lines }}"
+  when: rdp_gpo.stdout_lines is defined
 
 - name: Configure DC with raw Commands
   win_shell: "{{ item }}"