```

fix: correct trust relationship creation by passing explicit local admin credentials
**Changed:**

- Updated the trust creation PowerShell script to accept explicit local forest,
  admin, and password parameters, ensuring correct context is used for trust
  operations and preventing failures due to implicit credential usage
- Modified parameter passing in the trust creation task to supply local admin
  credentials and domain explicitly, improving reliability of trust setup
- Removed unused variable `domain_username` from playbook to avoid confusion
- Cleaned up unnecessary become variables in trust role task, as credentials
  are now passed directly to the script
```

Author: l50

ansible/playbooks/ad-trusts.yml

@@ -23,7 +23,6 @@
   - { role: 'dreadnode.goad.trusts', tags: 'trust' }
   vars:
     domain: "{{ lab.hosts[dict_key].domain }}"
-    domain_username: "{{ domain }}\\{{ admin_user }}"
     domain_password: "{{ lab.domains[domain].domain_password }}"
     remote_forest: "{{ lab.domains[domain].trust }}"
     remote_admin: "{{ admin_user }}@{{ remote_forest }}"

ansible/roles/trusts/tasks/main.yml

@@ -10,6 +10,15 @@
     script: |
       [CmdletBinding()]
       param (
+          [String]
+          $LocalForest,
+
+          [String]
+          $LocalAdmin,
+
+          [String]
+          $LocalAdminPassword,
+
           [String]
           $RemoteForest,
 
@@ -19,30 +28,27 @@
           [String]
           $RemoteAdminPassword
       )
-      $localforest=[System.DirectoryServices.ActiveDirectory.Forest]::getCurrentForest()
+      $localContext = New-Object -TypeName "System.DirectoryServices.ActiveDirectory.DirectoryContext" -ArgumentList @("Forest", $LocalForest, $LocalAdmin, $LocalAdminPassword)
+      $localForestObj = [System.DirectoryServices.ActiveDirectory.Forest]::getForest($localContext)
       try {
-        $localForest.GetTrustRelationship($RemoteForest)
+        $localForestObj.GetTrustRelationship($RemoteForest)
         $Ansible.Changed = $false
-        # Add proper output formatting
         Write-Output '{"status": "exists", "message": "Trust relationship already exists"}'
       } catch [System.DirectoryServices.ActiveDirectory.ActiveDirectoryObjectNotFoundException] {
         $Ansible.Changed = $true
-        $remoteContext = New-Object -TypeName "System.DirectoryServices.ActiveDirectory.DirectoryContext" -ArgumentList @( "Forest", $RemoteForest, $RemoteAdmin, $RemoteAdminPassword)
+        $remoteContext = New-Object -TypeName "System.DirectoryServices.ActiveDirectory.DirectoryContext" -ArgumentList @("Forest", $RemoteForest, $RemoteAdmin, $RemoteAdminPassword)
         $distantForest = [System.DirectoryServices.ActiveDirectory.Forest]::getForest($remoteContext)
-        $localForest.CreateTrustRelationship($distantForest,"Bidirectional")
-        # Add proper output formatting
+        $localForestObj.CreateTrustRelationship($distantForest,"Bidirectional")
         Write-Output '{"status": "created", "message": "Trust relationship created successfully"}'
       }
     error_action: stop
     parameters:
+      LocalForest: "{{ domain }}"
+      LocalAdmin: "{{ admin_user }}@{{ domain }}"
+      LocalAdminPassword: "{{ domain_password }}"
       RemoteForest: "{{ remote_forest }}"
       RemoteAdmin: "{{ remote_admin }}"
       RemoteAdminPassword: "{{ remote_admin_password }}"
-  vars:
-    ansible_become: true
-    ansible_become_method: ansible.builtin.runas
-    ansible_become_user: "{{ domain_username }}"
-    ansible_become_password: "{{ domain_password }}"
   register:
     trust_result