diff --git a/ansible/roles/windows/ipa-ad-data/tasks/ad-child.yml b/ansible/roles/windows/ipa-ad-data/tasks/ad-child.yml
index ec8c911c..f4f4d5ca 100644
--- a/ansible/roles/windows/ipa-ad-data/tasks/ad-child.yml
+++ b/ansible/roles/windows/ipa-ad-data/tasks/ad-child.yml
@@ -94,3 +94,33 @@
       AccountExpirationDate: (Get-Date).AddDays(-1)
       Enabled: $true
       OtherAttributes: "@{'uidNumber'='10149'; 'gidNumber'='10147'; 'loginShell'='/bin/sh'; 'homeDirectory'='/home/subexpiredaduser'; 'unixHomeDirectory'='/home/subexpiredaduser'; 'gecos'='Expired AD User'}"
+
+- name: AD child user with CannotChangePassword
+  include_role:
+    name: windows/ipa-ad-data
+    tasks_from: user.yml
+  vars:
+    options:
+      Name: subcantchgpwduser
+      GivenName: SubCannotChangePwd
+      Surname: User
+      AccountPassword: Secret123
+      PasswordNeverExpires: $true
+      CannotChangePassword: $true
+      Enabled: $true
+      OtherAttributes: "@{'uidNumber'='10150'; 'gidNumber'='10147'; 'loginShell'='/bin/sh'; 'homeDirectory'='/home/subcantchgpwduser'; 'unixHomeDirectory'='/home/subcantchgpwduser'; 'gecos'='Sub Cannot Change Password User'}"
+
+- name: AD child user with ChangePasswordAtLogon (must change password at next logon)
+  include_role:
+    name: windows/ipa-ad-data
+    tasks_from: user.yml
+  vars:
+    options:
+      Name: submustchgpwduser
+      GivenName: SubChangePwdAtLogon
+      Surname: User
+      AccountPassword: Secret123
+      ChangePasswordAtLogon: $true
+      PasswordNeverExpires: $false
+      Enabled: $true
+      OtherAttributes: "@{'uidNumber'='10151'; 'gidNumber'='10147'; 'loginShell'='/bin/sh'; 'homeDirectory'='/home/submustchgpwduser'; 'unixHomeDirectory'='/home/submustchgpwduser'; 'gecos'='Sub Change Password At Logon User'}"
diff --git a/ansible/roles/windows/ipa-ad-data/tasks/ad-root.yml b/ansible/roles/windows/ipa-ad-data/tasks/ad-root.yml
index 1bb89b7a..1ca6710c 100644
--- a/ansible/roles/windows/ipa-ad-data/tasks/ad-root.yml
+++ b/ansible/roles/windows/ipa-ad-data/tasks/ad-root.yml
@@ -187,3 +187,33 @@
       AccountExpirationDate: (Get-Date).AddDays(-1)
       Enabled: $true
       OtherAttributes: "@{'uidNumber'='10059'; 'gidNumber'='10047'; 'loginShell'='/bin/sh'; 'homeDirectory'='/home/expiredaduser'; 'unixHomeDirectory'='/home/expiredaduser'; 'gecos'='Expired AD User'}"
+
+- name: AD user with CannotChangePassword
+  include_role:
+    name: windows/ipa-ad-data
+    tasks_from: user.yml
+  vars:
+    options:
+      Name: cannotchangepwduser
+      GivenName: CannotChangePwd
+      Surname: User
+      AccountPassword: Secret123
+      PasswordNeverExpires: $true
+      CannotChangePassword: $true
+      Enabled: $true
+      OtherAttributes: "@{'uidNumber'='10061'; 'gidNumber'='10047'; 'loginShell'='/bin/sh'; 'homeDirectory'='/home/cannotchangepwduser'; 'unixHomeDirectory'='/home/cannotchangepwduser'; 'gecos'='Cannot Change Password User'}"
+
+- name: AD user with ChangePasswordAtLogon (must change password at next logon)
+  include_role:
+    name: windows/ipa-ad-data
+    tasks_from: user.yml
+  vars:
+    options:
+      Name: changepwdatlogonuser
+      GivenName: ChangePwdAtLogon
+      Surname: User
+      AccountPassword: Secret123
+      ChangePasswordAtLogon: $true
+      PasswordNeverExpires: $false
+      Enabled: $true
+      OtherAttributes: "@{'uidNumber'='10062'; 'gidNumber'='10047'; 'loginShell'='/bin/sh'; 'homeDirectory'='/home/changepwdatlogonuser'; 'unixHomeDirectory'='/home/changepwdatlogonuser'; 'gecos'='Change Password At Logon User'}"