diff --git a/tests/config/test_config.yml b/tests/config/test_config.yml
index e1d33f791d68671d95bd82dcae16a640d0bbd486..931da5e05e45c157e268cd93a3cd71bcca4e3a5e 100644
--- a/tests/config/test_config.yml
+++ b/tests/config/test_config.yml
@@ -110,84 +110,84 @@
       ipaadmin_password: SomeADMINpassword
       emaildomain: somedomain.test
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure the default e-mail domain is somedomain.test, again.
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       emaildomain: somedomain.test
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: set default shell to '/bin/someshell'
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       defaultshell: /bin/someshell
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: set default shell to '/bin/someshell', again.
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       defaultshell: /bin/someshell
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: set default group
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       defaultgroup: somedefaultgroup
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
-  - name: set default group
+  - name: set default group, again
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       defaultgroup: somedefaultgroup
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: set default home directory
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       homedirectory: /Users
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
-  - name: set default home directory
+  - name: set default home directory, again
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       homedirectory: /Users
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: set pac-type
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       pac_type: "nfs:NONE"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: set pac-type, again.
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       pac_type: "nfs:NONE"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: set maxusername to 33
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       maxusername: 33
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: set maxusername to 33, again.
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       maxusername: 33
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: set maxhostname to 77
     block:
@@ -195,13 +195,13 @@
           ipaadmin_password: SomeADMINpassword
           maxhostname: 77
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - ipaconfig:
           ipaadmin_password: SomeADMINpassword
           maxhostname: 77
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
     when: ipa_version is version('4.8.0', '>=')
 
   - name: set pwdexpnotify to 17
@@ -209,126 +209,126 @@
       ipaadmin_password: SomeADMINpassword
       pwdexpnotify: 17
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: set pwdexpnotify to 17, again
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       pwdexpnotify: 17
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: set searchrecordslimit to -1
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       searchrecordslimit: -1
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: set searchrecordslimit to -1, again.
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       searchrecordslimit: -1
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: set searchtimelimit to 12345
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       searchtimelimit: 12345
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: set searchtimelimit to 12345, again.
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       searchtimelimit: 12345
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: change enable_migration
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       enable_migration: '{{ not previousconfig.config.enable_migration }}'
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: change enable_migration, again
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       enable_migration: '{{ not previousconfig.config.enable_migration }}'
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: set configstring to AllowNThash
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       configstring: AllowNThash
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: set configstring to AllowNThash, again.
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       configstring: AllowNThash
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: set selinuxusermaporder
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       selinuxusermaporder: 'user_u:s0$staff_u:s0-s0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023'
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: set selinuxusermaporder, again
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       selinuxusermaporder: 'user_u:s0$staff_u:s0-s0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023'
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: set selinuxusermapdefault
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       selinuxusermapdefault: 'user_u:s0'
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: set selinuxusermapdefault, again
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       selinuxusermapdefault: 'user_u:s0'
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: set groupsearch to `description`
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       groupsearch: description
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: set groupsearch to `gidNumber`, again
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       groupsearch: description
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: set usersearch to `uidNumber`
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       usersearch: uidNumber
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: set usersearch to `uidNumber`, again
     ipaconfig:
       ipaadmin_password: SomeADMINpassword
       usersearch: uidNumber
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: reset changed fields
     ipaconfig:
@@ -354,7 +354,7 @@
       domain_resolution_order: '{{previousconfig.config.domain_resolution_order | default(omit)}}'
       ca_renewal_master_server: '{{previousconfig.config.ca_renewal_master_server | default(omit)}}'
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: reset maxhostname
     block:
@@ -387,7 +387,7 @@
       domain_resolution_order: '{{previousconfig.config.domain_resolution_order | default(omit)}}'
       ca_renewal_master_server: '{{previousconfig.config.ca_renewal_master_server | default(omit)}}'
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: reset maxhostname
     block:
diff --git a/tests/dnsconfig/test_dnsconfig.yml b/tests/dnsconfig/test_dnsconfig.yml
index 12781e0b56f303f7dcfb8ee00daf4183a649b61d..3a69bea81dceb72345bbb799e21ba41f1d4d8ad8 100644
--- a/tests/dnsconfig/test_dnsconfig.yml
+++ b/tests/dnsconfig/test_dnsconfig.yml
@@ -53,7 +53,7 @@
       forward_policy: only
       allow_sync_ptr: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Set dnsconfig, with the same values.
     ipadnsconfig:
@@ -66,7 +66,7 @@
       forward_policy: only
       allow_sync_ptr: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure forwarder is absent.
     ipadnsconfig:
@@ -75,7 +75,7 @@
         - ip_address: 8.8.8.8
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure forwarder is absent, again.
     ipadnsconfig:
@@ -84,63 +84,63 @@
         - ip_address: 8.8.8.8
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Disable global forwarders.
     ipadnsconfig:
       ipaadmin_password: SomeADMINpassword
       forward_policy: none
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Disable global forwarders, again.
     ipadnsconfig:
       ipaadmin_password: SomeADMINpassword
       forward_policy: none
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Re-enable global forwarders.
     ipadnsconfig:
       ipaadmin_password: SomeADMINpassword
       forward_policy: first
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Re-enable global forwarders, again.
     ipadnsconfig:
       ipaadmin_password: SomeADMINpassword
       forward_policy: first
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Disable PTR record synchronization.
     ipadnsconfig:
       ipaadmin_password: SomeADMINpassword
       allow_sync_ptr: no
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Disable PTR record synchronization, again.
     ipadnsconfig:
       ipaadmin_password: SomeADMINpassword
       allow_sync_ptr: no
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Re-enable PTR record synchronization.
     ipadnsconfig:
       ipaadmin_password: SomeADMINpassword
       allow_sync_ptr: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Re-enable PTR record synchronization, again.
     ipadnsconfig:
       ipaadmin_password: SomeADMINpassword
       allow_sync_ptr: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure all forwarders are absent.
     ipadnsconfig:
@@ -152,7 +152,7 @@
           port: 53
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
 
   - name: Ensure all forwarders are absent, again.
@@ -165,7 +165,7 @@
           port: 53
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # Cleanup.
   - name: Ensure forwarders are absent.
diff --git a/tests/dnsforwardzone/test_dnsforwardzone.yml b/tests/dnsforwardzone/test_dnsforwardzone.yml
index 223cf3d090b5e44192bd7e8f0476aba3350a339f..b9569faa4c0b643ccfe425e1debcf61fb9fb69d6 100644
--- a/tests/dnsforwardzone/test_dnsforwardzone.yml
+++ b/tests/dnsforwardzone/test_dnsforwardzone.yml
@@ -23,7 +23,7 @@
       forwardpolicy: first
       skip_overlap_check: true
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: ensure forwardzone example.com is present again
     ipadnsforwardzone:
@@ -35,7 +35,7 @@
       forwardpolicy: first
       skip_overlap_check: true
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: ensure forwardzone example.com has two forwarders
     ipadnsforwardzone:
@@ -49,7 +49,7 @@
       forwardpolicy: first
       skip_overlap_check: true
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: ensure forwardzone example.com has one forwarder again
     ipadnsforwardzone:
@@ -61,7 +61,7 @@
       skip_overlap_check: true
       state: present
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: skip_overlap_check can only be set on creation so change nothing
     ipadnsforwardzone:
@@ -73,7 +73,7 @@
       skip_overlap_check: false
       state: present
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: ensure forwardzone example.com is absent.
     ipadnsforwardzone:
@@ -81,7 +81,7 @@
       name: example.com
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: ensure forwardzone example.com is absent, again.
     ipadnsforwardzone:
@@ -89,7 +89,7 @@
       name: example.com
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: change all the things at once
     ipadnsforwardzone:
@@ -104,7 +104,7 @@
       skip_overlap_check: true
       permission: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: change zone forward policy
     ipadnsforwardzone:
@@ -112,7 +112,7 @@
       name: example.com
       forwardpolicy: first
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: change zone forward policy, again
     ipadnsforwardzone:
@@ -120,13 +120,23 @@
       name: example.com
       forwardpolicy: first
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: ensure forwardzone example.com is absent.
     ipadnsforwardzone:
       ipaadmin_password: SomeADMINpassword
       name: example.com
       state: absent
+    register: result
+    failed_when: not result.changed or result.failed
+
+  - name: ensure forwardzone example.com is absent, again.
+    ipadnsforwardzone:
+      ipaadmin_password: SomeADMINpassword
+      name: example.com
+      state: absent
+    register: result
+    failed_when: result.changed or result.failed
 
   - name: ensure forwardzone example.com is created with minimal args
     ipadnsforwardzone:
@@ -137,7 +147,18 @@
       forwarders:
         - ip_address: 8.8.8.8
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
+
+  - name: ensure forwardzone example.com is created with minimal args, again
+    ipadnsforwardzone:
+      ipaadmin_password: SomeADMINpassword
+      state: present
+      name: example.com
+      skip_overlap_check: true
+      forwarders:
+        - ip_address: 8.8.8.8
+    register: result
+    failed_when: result.changed or result.failed
 
   - name: add a forwarder to any existing ones
     ipadnsforwardzone:
@@ -149,7 +170,19 @@
           port: 8053
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
+
+  - name: add a forwarder to any existing ones, again
+    ipadnsforwardzone:
+      ipaadmin_password: SomeADMINpassword
+      state: present
+      name: example.com
+      forwarders:
+        - ip_address: 4.4.4.4
+          port: 8053
+      action: member
+    register: result
+    failed_when: result.changed or result.failed
 
   - name: check the list of forwarders is what we expect
     ipadnsforwardzone:
@@ -162,7 +195,7 @@
         - ip_address: 8.8.8.8
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: remove a single forwarder
     ipadnsforwardzone:
@@ -173,7 +206,18 @@
         - ip_address: 8.8.8.8
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
+
+  - name: remove a single forwarder, again
+    ipadnsforwardzone:
+      ipaadmin_password: SomeADMINpassword
+      state: absent
+      name: example.com
+      forwarders:
+        - ip_address: 8.8.8.8
+      action: member
+    register: result
+    failed_when: result.changed or result.failed
 
   - name: check the list of forwarders is what we expect now
     ipadnsforwardzone:
@@ -185,7 +229,7 @@
           port: 8053
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Add a permission for per-forward zone access delegation.
     ipadnsforwardzone:
@@ -194,7 +238,7 @@
       permission: yes
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Add a permission for per-forward zone access delegation, again.
     ipadnsforwardzone:
@@ -203,7 +247,7 @@
       permission: yes
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Remove a permission for per-forward zone access delegation.
     ipadnsforwardzone:
@@ -212,7 +256,7 @@
       permission: no
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Remove a permission for per-forward zone access delegation, again.
     ipadnsforwardzone:
@@ -221,7 +265,7 @@
       permission: no
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: disable the forwarder
     ipadnsforwardzone:
@@ -229,7 +273,7 @@
       name: example.com
       state: disabled
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: disable the forwarder again
     ipadnsforwardzone:
@@ -237,7 +281,7 @@
       name: example.com
       state: disabled
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: enable the forwarder
     ipadnsforwardzone:
@@ -245,7 +289,7 @@
       name: example.com
       state: enabled
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: enable the forwarder, again
     ipadnsforwardzone:
@@ -253,7 +297,7 @@
       name: example.com
       state: enabled
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: ensure forwardzone example.com is absent again
     ipadnsforwardzone:
diff --git a/tests/dnsrecord/env_vars.yml b/tests/dnsrecord/env_vars.yml
index d95e1381fc52ee5afa1800d84e64959b7bdabd74..0e979988e2283823db6f35efb48acd65f5ef9471 100644
--- a/tests/dnsrecord/env_vars.yml
+++ b/tests/dnsrecord/env_vars.yml
@@ -4,9 +4,9 @@
   set_fact:
     ipv4_prefix: "{{ ansible_facts['default_ipv4'].address.split('.')[:-1] |
                      join('.') }}"
-    ipv4_reverse_sufix: "{{ ansible_facts['default_ipv4'].address.split('.')[:-1] |
-                            reverse |
-                            join('.') }}"
+    ipv4_reverse: "{{ ansible_facts['default_ipv4'].address.split('.')[:-1] |
+                      reverse |
+                      join('.') }}"
 
 - name: Set zone prefixes.
   set_fact:
@@ -14,7 +14,7 @@
     safezone: 'safezone.test'
     zone_ipv6_reverse: "ip6.arpa."
     zone_ipv6_reverse_workaround: "d.f.ip6.arpa."
-    zone_prefix_reverse: "in-addr.arpa"
-    zone_prefix_reverse_24: "{{ ipv4_prefix.split('.')[::-1] | join ('.') }}.in-addr.arpa"
-    zone_prefix_reverse_16: "{{ ipv4_prefix.split('.')[1::-1] | join ('.') }}.in-addr.arpa"
-    zone_prefix_reverse_8: "{{ ipv4_prefix.split('.')[2::-1] | join ('.') }}.in-addr.arpa"
+    zone_prefix_reverse: "in-addr.arpa."
+    zone_prefix_reverse_24: "{{ ipv4_reverse.split('.')[:] | join ('.') }}.in-addr.arpa."
+    zone_prefix_reverse_16: "{{ ipv4_reverse.split('.')[1:] | join ('.') }}.in-addr.arpa."
+    zone_prefix_reverse_8: "{{ ipv4_reverse.split('.')[2:] | join ('.') }}.in-addr.arpa."
diff --git a/tests/dnsrecord/test_dnsrecord.yml b/tests/dnsrecord/test_dnsrecord.yml
index 05379ce4607a48029a9e2bb33d081d2c896d4375..5b5d48a9cb45e5cf0d8e5f2b57dcb15e6bbe5177 100644
--- a/tests/dnsrecord/test_dnsrecord.yml
+++ b/tests/dnsrecord/test_dnsrecord.yml
@@ -28,7 +28,7 @@
       record_type: AAAA
       record_value: ::1
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that dns record 'host01' is present, again
     ipadnsrecord:
@@ -38,7 +38,7 @@
       record_type: AAAA
       record_value: ::1
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that dns record 'host02' is present
     ipadnsrecord:
@@ -48,7 +48,7 @@
       record_type: A
       record_value: "{{ ipv4_prefix }}.102"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that dns record 'host02' is present, again
     ipadnsrecord:
@@ -58,7 +58,7 @@
       record_type: A
       record_value: "{{ ipv4_prefix }}.102"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Modify record 'host02' with multiple A and AAAA record.
     ipadnsrecord:
@@ -75,7 +75,7 @@
           record_type: AAAA
           record_value: ::1
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Modify record 'host02' with multiple A and AAAA record, again.
     ipadnsrecord:
@@ -92,7 +92,7 @@
           record_type: AAAA
           record_value: ::1
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure 'host02' A6 record is present.
     ipadnsrecord:
@@ -101,7 +101,7 @@
       name: host02
       a6_data: ::1
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure 'host02' A6 record is present, again.
     ipadnsrecord:
@@ -110,7 +110,7 @@
       name: host02
       a6_rec: ::1
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure 'host02' A6 record is absent.
     ipadnsrecord:
@@ -120,7 +120,7 @@
       a6_rec: ::1
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure 'host02' A6 record is absent, again.
     ipadnsrecord:
@@ -130,7 +130,7 @@
       a6_rec: ::1
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that dns record 'host03' is present, with reverse record.
     ipadnsrecord:
@@ -140,7 +140,7 @@
       a_ip_address: "{{ ipv4_prefix }}.103"
       a_create_reverse: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that dns record 'host03' is present, with reverse record, again
     ipadnsrecord:
@@ -151,7 +151,7 @@
       record_value: "{{ ipv4_prefix }}.103"
       create_reverse: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Delete all entries associated with host03
     ipadnsrecord:
@@ -161,7 +161,7 @@
       del_all: yes
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Delete all entries associated with host03, again
     ipadnsrecord:
@@ -171,7 +171,7 @@
       del_all: yes
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' has CNAME
     ipadnsrecord:
@@ -181,7 +181,7 @@
       record_type: CNAME
       record_value: "host04.{{ testzone }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' has CNAME, again
     ipadnsrecord:
@@ -190,7 +190,7 @@
       name: host04
       cname_hostname: "host04.{{ testzone }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' CNAME is absent
     ipadnsrecord:
@@ -200,7 +200,7 @@
       cname_rec: "host04.{{ testzone }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' CNAME is absent, again
     ipadnsrecord:
@@ -211,7 +211,7 @@
       record_value: "host04.{{ testzone }}"
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' and 'host03' have CNAME, with cname_hostname
     ipadnsrecord:
@@ -223,7 +223,7 @@
         - name: host03
           cname_hostname: "host03.{{ testzone }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' has CNAME, with cname_hostname, again
     ipadnsrecord:
@@ -232,7 +232,7 @@
       name: host04
       cname_hostname: "host04.{{ testzone }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' CNAME is absent.
     ipadnsrecord:
@@ -242,7 +242,7 @@
       cname_rec: "host04.{{ testzone }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' has A record.
     ipadnsrecord:
@@ -251,7 +251,7 @@
       name: host04
       ip_address: "{{ ipv4_prefix }}.104"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' has A record, again.
     ipadnsrecord:
@@ -260,7 +260,7 @@
       name: host04
       ip_address: "{{ ipv4_prefix }}.104"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' has the same A record with reverse.
     ipadnsrecord:
@@ -270,7 +270,7 @@
       a_rec: "{{ ipv4_prefix }}.104"
       reverse: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' has the same A record with reverse, again.
     ipadnsrecord:
@@ -280,17 +280,18 @@
       a_rec: "{{ ipv4_prefix }}.104"
       reverse: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
-  - name: Ensure that 'host04' has an A record with reverse, for NS record.
+  - name: Ensure that 'host04' has another A record with reverse.
     ipadnsrecord:
       ipaadmin_password: SomeADMINpassword
       zone_name: "{{ testzone }}"
       name: host04
       ip_address: "{{ ipv4_prefix }}.114"
       reverse: yes
+    failed_when: result.changed or result.failed
 
-  - name: Ensure that 'host04' has an A record with reverse, again.
+  - name: Ensure that 'host04' has another A record with reverse, again.
     ipadnsrecord:
       ipaadmin_password: SomeADMINpassword
       zone_name: "{{ testzone }}"
@@ -298,7 +299,7 @@
       ip_address: "{{ ipv4_prefix }}.114"
       reverse: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' has AAAA record.
     ipadnsrecord:
@@ -308,7 +309,7 @@
       aaaa_ip_address: fd00::0004
       aaaa_create_reverse: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' has AAAA record, again.
     ipadnsrecord:
@@ -318,7 +319,7 @@
       ip_address: fd00::0004
       reverse: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' has AAAA record, without reverse.
     ipadnsrecord:
@@ -327,7 +328,7 @@
       name: host04
       ip_address: fd00::0014
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' previous AAAA record, now has a reverse record.
     ipadnsrecord:
@@ -337,7 +338,7 @@
       aaaa_rec: fd00::0014
       reverse: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' previous AAAA record, now has a reverse record, again.
     ipadnsrecord:
@@ -347,7 +348,7 @@
       aaaa_rec: fd00::0014
       reverse: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' has PTR record.
     ipadnsrecord:
@@ -356,7 +357,7 @@
       name: "124"
       ptr_hostname: "host04.{{ testzone }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' has PTR record, again.
     ipadnsrecord:
@@ -365,7 +366,7 @@
       name: "124"
       ptr_hostname: "host04.{{ testzone }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' has PTR record is absent.
     ipadnsrecord:
@@ -375,7 +376,7 @@
       ptr_rec: "host04.{{ testzone }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' has PTR record is absent, again.
     ipadnsrecord:
@@ -385,7 +386,7 @@
       ptr_rec: "host04.{{ testzone }}"
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' has DNAME record.
     ipadnsrecord:
@@ -394,7 +395,7 @@
       name: host04
       dname_target: "ipa.{{ testzone }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' has DNAME record, again.
     ipadnsrecord:
@@ -403,7 +404,7 @@
       name: host04
       dname_target: "ipa.{{ testzone }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' DNAME record is absent.
     ipadnsrecord:
@@ -413,7 +414,7 @@
       dname_rec: "ipa.{{ testzone }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' DNAME record is absent, again.
     ipadnsrecord:
@@ -423,8 +424,10 @@
       dname_rec: "ipa.{{ testzone }}"
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
+  # This task only ensures proper records are present,
+  # it is not testing anything, and should not faild.
   - name: Ensure that 'host04' has a A record with reverse, for NS record.
     ipadnsrecord:
       ipaadmin_password: SomeADMINpassword
@@ -432,6 +435,8 @@
       name: host04
       ip_address: "{{ ipv4_prefix }}.114"
       reverse: yes
+    register: result
+    failed_when: result.failed
 
   - name: Ensure that 'host04' has NS record.
     ipadnsrecord:
@@ -440,7 +445,7 @@
       name: host04
       ns_hostname: host04
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' has NS record, again.
     ipadnsrecord:
@@ -449,7 +454,9 @@
       name: host04
       ns_hostname: host04
     register: result
-    failed_when: result.changed
+    # IPA issue 8850 should be fixed before we handle the failed_when
+    # message. For now, we'll just test if it does not fail.
+    failed_when: result.changed or not result.failed
 
   - name: Ensure that 'host04' NS record is absent.
     ipadnsrecord:
@@ -459,7 +466,7 @@
       ns_rec: host04
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' NS record is absent, again.
     ipadnsrecord:
@@ -469,7 +476,7 @@
       ns_rec: host04
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' DLV record is present.
     ipadnsrecord:
@@ -566,7 +573,7 @@
       zone_name: "{{ safezone }}"
       ip_address: "{{ ansible_facts['default_ipv4'].address }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that NS record for "{{ safezone }}" is present
     ipadnsrecord:
@@ -575,7 +582,7 @@
       zone_name: "{{ safezone }}"
       ns_hostname: iron01
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'iron01' DS record is present.
     ipadnsrecord:
@@ -588,7 +595,7 @@
       # digest is sha1sum of 'iron01."{{ safezone }}"'
       ds_digest: 84763786e4213cca9a6938dba5dacd64f87ec216
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'iron01' DS record is present, again.
     ipadnsrecord:
@@ -600,7 +607,7 @@
       ds_digest_type: 1
       ds_digest: 84763786e4213cca9a6938dba5dacd64f87ec216
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'iron01' DS record is present, with a different key tag.
     ipadnsrecord:
@@ -610,7 +617,7 @@
       ds_key_tag: 54321
       ds_rec: 12345 3 1 84763786e4213cca9a6938dba5dacd64f87ec216
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'iron01' DS record is present, with a different key tag, again.
     ipadnsrecord:
@@ -620,7 +627,7 @@
       ds_key_tag: 54321
       ds_rec: 12345 3 1 84763786e4213cca9a6938dba5dacd64f87ec216
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or (result.failed and "DS record does not contain" not in result.msg)
 
   - name: Ensure that 'iron01' DS record is absent.
     ipadnsrecord:
@@ -630,7 +637,7 @@
       ds_rec: 54321 3 1 84763786e4213cca9a6938dba5dacd64f87ec216
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'iron01' DS record is absent, again.
     ipadnsrecord:
@@ -640,7 +647,7 @@
       ds_rec: 54321 3 1 84763786e4213cca9a6938dba5dacd64f87ec216
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' AFSDB record is present.
     ipadnsrecord:
@@ -650,7 +657,7 @@
       afsdb_subtype: 1
       afsdb_hostname: "host04.{{ testzone }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' AFSDB record is present, again.
     ipadnsrecord:
@@ -660,7 +667,7 @@
       afsdb_subtype: 1
       afsdb_hostname: "host04.{{ testzone }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' AFSDB record subtype is 2.
     ipadnsrecord:
@@ -670,7 +677,7 @@
       afsdb_subtype: 2
       afsdb_rec: "1 host04.{{ testzone }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' AFSDB record subtype is 2, again.
     ipadnsrecord:
@@ -680,7 +687,7 @@
       afsdb_subtype: 2
       afsdb_rec: "1 host04.{{ testzone }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or (result.failed and "AFSDB record does not contain" not in result.msg)
 
   - name: Ensure that 'host04' AFSDB record is absent.
     ipadnsrecord:
@@ -690,7 +697,7 @@
       afsdb_rec: "2 host04.{{ testzone }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' AFSDB record is absent, again.
     ipadnsrecord:
@@ -700,7 +707,7 @@
       afsdb_rec: "2 host04.{{ testzone }}"
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' CERT record is present.
     ipadnsrecord:
@@ -712,7 +719,7 @@
       cert_algorithm: 3
       cert_certificate_or_crl: "{{ lookup('file', 'cert1.b64') }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' CERT record is present, again.
     ipadnsrecord:
@@ -724,7 +731,7 @@
       cert_algorithm: 3
       cert_certificate_or_crl: "{{ lookup('file', 'cert1.b64') }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' CERT record is absent.
     ipadnsrecord:
@@ -734,7 +741,7 @@
       cert_rec: "1 1234 3 {{ lookup('file', 'cert1.b64') }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' CERT record is absent, again.
     ipadnsrecord:
@@ -744,7 +751,7 @@
       cert_rec: 1 1234 3 "{{ lookup('file', 'cert1.b64') }}"
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' KX record is present.
     ipadnsrecord:
@@ -754,7 +761,7 @@
       kx_preference: 10
       kx_exchanger: "keyex.{{ testzone }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' KX record is present, again.
     ipadnsrecord:
@@ -764,7 +771,7 @@
       kx_preference: 10
       kx_exchanger: "keyex.{{ testzone }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' KX record is present with preference set to 20.
     ipadnsrecord:
@@ -774,7 +781,7 @@
       kx_preference: 20
       kx_rec: "10 keyex.{{ testzone }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' KX record is present with preference set to 20, again.
     ipadnsrecord:
@@ -784,7 +791,7 @@
       kx_preference: 20
       kx_rec: "10 keyex.{{ testzone }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or (result.failed and "KX record does not contain" not in result.msg)
 
   - name: Ensure that 'host04' KX record is present with preference set to 20, one more time.
     ipadnsrecord:
@@ -794,7 +801,7 @@
       kx_preference: 20
       kx_rec: "20 keyex.{{ testzone }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' KX record is absent.
     ipadnsrecord:
@@ -804,7 +811,7 @@
       kx_rec: "20 keyex.{{ testzone }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' KX record is absent, again.
     ipadnsrecord:
@@ -814,7 +821,7 @@
       kx_rec: "20 keyex.{{ testzone }}"
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' MX record is present.
     ipadnsrecord:
@@ -824,7 +831,7 @@
       mx_preference: 10
       mx_exchanger: "mail.{{ testzone }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' MX record is present, again.
     ipadnsrecord:
@@ -834,7 +841,7 @@
       mx_preference: 10
       mx_exchanger: "mail.{{ testzone }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' MX record is present with preference set to 20.
     ipadnsrecord:
@@ -844,7 +851,7 @@
       mx_preference: 20
       mx_rec: "10 mail.{{ testzone }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' MX record is absent.
     ipadnsrecord:
@@ -854,7 +861,7 @@
       mx_rec: "20 mail.{{ testzone }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' MX record is absent, again.
     ipadnsrecord:
@@ -864,7 +871,7 @@
       mx_rec: "20 mail.{{ testzone }}"
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' LOC record is present.
     ipadnsrecord:
@@ -884,7 +891,7 @@
       loc_h_precision: 10000
       loc_v_precision: 10
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' LOC record is present, again.
     ipadnsrecord:
@@ -904,7 +911,7 @@
       loc_h_precision: 10000
       loc_v_precision: 10
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' LOC record is present, with loc_size 1.00.
     ipadnsrecord:
@@ -914,7 +921,7 @@
       loc_size: 1.00
       loc_rec: 52 22 23.000 N 4 53 32.000 E -2.00 0.00 10000.00 10.00
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' LOC record is absent.
     ipadnsrecord:
@@ -924,7 +931,7 @@
       loc_rec: 52 22 23.000 N 4 53 32.000 E -2.00 1.00 10000.00 10.00
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' LOC record is absent, again.
     ipadnsrecord:
@@ -934,7 +941,7 @@
       loc_rec: 52 22 23.000 N 4 53 32.000 E -2.00 1.00 10000.00 10.00
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that '_sip._udp' service has NAPTR record.
     ipadnsrecord:
@@ -948,7 +955,7 @@
       naptr_regexp: "!^.*$!sip:info@example.com!"
       naptr_replacement: "."
     register: result
-    failed_when: result.failed or not result.changed
+    failed_when: result.failed or not result.changed or result.failed
 
   - name: Ensure that '_sip._udp' service has NAPTR record, again.
     ipadnsrecord:
@@ -1049,7 +1056,7 @@
       srv_port: 5060
       srv_target: "sip-server.{{ testzone }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that '_sip._udp' service has SRV record, again.
     ipadnsrecord:
@@ -1061,7 +1068,7 @@
       srv_port: 5060
       srv_target: "sip-server.{{ testzone }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure '_sip._udp' SRV record has priority equals to 4.
     ipadnsrecord:
@@ -1074,7 +1081,7 @@
       srv_target: "sip-server.{{ testzone }}"
       srv_rec: "10 10 5060 sip-server.{{ testzone }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure '_sip._udp' SRV record has priority equals to 4, again.
     ipadnsrecord:
@@ -1087,7 +1094,7 @@
       srv_target: sip-server."{{ testzone }}"
       srv_rec: "10 10 5060 sip-server.{{ testzone }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or (result.failed and "SRV record does not contain" not in result.msg)
 
   - name: Ensurer '_sip._udp' SRV record has priority 2, weight 20
     ipadnsrecord:
@@ -1099,7 +1106,7 @@
       srv_port: 5060
       srv_target: "sip-server.{{ testzone }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensurer '_sip._udp' SRV record has priority 2, weight 20, again.
     ipadnsrecord:
@@ -1111,7 +1118,7 @@
       srv_port: 5060
       srv_target: "sip-server.{{ testzone }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that '_sip._udp' SRV record is absent.
     ipadnsrecord:
@@ -1121,7 +1128,7 @@
       srv_record: "2 20 5060 sip-server.{{ testzone }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that '_sip._udp' SRV record is absent, again.
     ipadnsrecord:
@@ -1131,7 +1138,7 @@
       srv_record: "2 20 5060 sip-server.{{ testzone }}"
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # SSHFP fingerprint generated with `ssh-keygen -r host04."{{ testzone }}"`
   - name: Ensure that 'host04' has SSHFP record.
@@ -1143,7 +1150,7 @@
       sshfp_fp_type: 1
       sshfp_fingerprint: d21802c61733e055b8d16296cbce300efb8a167a
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' has SSHFP record, again.
     ipadnsrecord:
@@ -1154,7 +1161,7 @@
       sshfp_fp_type: 1
       sshfp_fingerprint: d21802c61733e055b8d16296cbce300efb8a167a
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' SSHFP record is absent.
     ipadnsrecord:
@@ -1164,7 +1171,7 @@
       sshfp_rec: 1 1 d21802c61733e055b8d16296cbce300efb8a167a
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' SSHFP record is absent, again.
     ipadnsrecord:
@@ -1174,7 +1181,7 @@
       sshfp_rec: 1 1 d21802c61733e055b8d16296cbce300efb8a167a
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # Data is sha356sum of 'Some Text to Test', it should be created from
   # a real certificate.
@@ -1188,7 +1195,7 @@
       tlsa_matching_type: 1
       tlsa_cert_association_data: 9c0ad776dbeae8d9d55b0ad42899d30235c114d5f918fd69746e4279e47bdaa2
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' has TLSA record present, again.
     ipadnsrecord:
@@ -1200,7 +1207,7 @@
       tlsa_matching_type: 1
       tlsa_cert_association_data: 9c0ad776dbeae8d9d55b0ad42899d30235c114d5f918fd69746e4279e47bdaa2
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Modify 'host04' has TLSA record.
     ipadnsrecord:
@@ -1210,7 +1217,7 @@
       tlsa_matching_type: 0
       tlsa_rec: 3 1 1 9c0ad776dbeae8d9d55b0ad42899d30235c114d5f918fd69746e4279e47bdaa2
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Modify 'host04' has TLSA record, again.
     ipadnsrecord:
@@ -1220,7 +1227,7 @@
       tlsa_matching_type: 0
       tlsa_rec: 3 1 1 9c0ad776dbeae8d9d55b0ad42899d30235c114d5f918fd69746e4279e47bdaa2
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or (result.failed and "TLSA record does not contain" not in result.msg)
 
   - name: Ensure that 'host04' TLSA record is absent.
     ipadnsrecord:
@@ -1230,7 +1237,7 @@
       tlsa_rec: 3 1 0 9c0ad776dbeae8d9d55b0ad42899d30235c114d5f918fd69746e4279e47bdaa2
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' TLSA record is absent, again.
     ipadnsrecord:
@@ -1240,7 +1247,7 @@
       tlsa_rec: 3 1 0 9c0ad776dbeae8d9d55b0ad42899d30235c114d5f918fd69746e4279e47bdaa2
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' has TXT record present.
     ipadnsrecord:
@@ -1249,7 +1256,7 @@
       name: host04
       txt_data: Some Text
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   # - name: Ensure that 'host04' has TXT record present, again.
   #   ipadnsrecord:
@@ -1258,7 +1265,7 @@
   #     name: host04
   #     txt_data: Some Text
   #   register: result
-  #   failed_when: result.changed
+  #   failed_when: result.changed or result.failed
 
   - name: Change value of  'host04' TXT record.
     ipadnsrecord:
@@ -1268,7 +1275,7 @@
       txt_data: Some new Text
       txt_rec: Some Text
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Add a second TXT record to 'host04'.
     ipadnsrecord:
@@ -1277,7 +1284,7 @@
       name: host04
       txt_rec: Some Other Text
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Add a second TXT record to 'host04', again.
     ipadnsrecord:
@@ -1286,7 +1293,7 @@
       name: host04
       txt_rec: Some Other Text
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that one of 'host04' TXT record is absent.
     ipadnsrecord:
@@ -1296,7 +1303,7 @@
       txt_rec: Some new Text
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that one of 'host04' TXT record is absent, again.
     ipadnsrecord:
@@ -1306,7 +1313,7 @@
       txt_rec: Some new Text
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that 'host04' TXT record are all absent.
     ipadnsrecord:
@@ -1318,7 +1325,7 @@
       - Some Other Text
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that 'host04' TXT record are all absent, again.
     ipadnsrecord:
@@ -1330,7 +1337,7 @@
       - Some Other Text
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that '_ftp._tcp' has URI record.
     ipadnsrecord:
@@ -1341,7 +1348,7 @@
       uri_weight: 1
       uri_target: ftp://ftp.host04.{{ testzone }}/public
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that '_ftp._tcp' has URI record, again
     ipadnsrecord:
@@ -1352,7 +1359,7 @@
       uri_weight: 1
       uri_target: ftp://ftp.host04.{{ testzone }}/public
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Change '_ftp._tcp' URI record weight to 3 and priority to 5.
     ipadnsrecord:
@@ -1363,14 +1370,17 @@
       uri_weight: 3
       uri_rec: 10 1 "ftp://ftp.host04.{{ testzone }}/public"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Verify if modification worked.
     ipadnsrecord:
+      ipaadmin_password: SomeADMINpassword
+      zone_name: "{{ testzone }}"
+      name: _ftp._tcp
       uri_rec: 10 1 ftp://ftp.host04.{{ testzone }}/public
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
 
   - name: Change '_ftp._tcp' URI record weight to 3 and priority to 5, again.
@@ -1382,7 +1392,7 @@
       uri_weight: 3
       uri_rec: 5 3 "ftp://ftp.host04.{{ testzone }}/public"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that '_ftp._tcp' URI record is absent.
     ipadnsrecord:
@@ -1392,7 +1402,7 @@
       uri_rec: 5 3 "ftp://ftp.host04.{{ testzone }}/public"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that '_ftp._tcp' URI record is absent, again.
     ipadnsrecord:
@@ -1402,7 +1412,7 @@
       uri_rec: 5 3 "ftp://ftp.host04.{{ testzone }}/public"
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # cleanup
   - name: Cleanup test environment.
diff --git a/tests/dnsrecord/test_dnsrecord_full_records.yml b/tests/dnsrecord/test_dnsrecord_full_records.yml
index 86e124c882b4415fb93cd217687912e645e0c6d1..cd703d137ea11fab94bd857d094d07c3436b312d 100644
--- a/tests/dnsrecord/test_dnsrecord_full_records.yml
+++ b/tests/dnsrecord/test_dnsrecord_full_records.yml
@@ -18,7 +18,7 @@
       zone_name: "{{ testzone }}"
       a_rec: 192.168.122.101
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that dns A record for 'host01' is present, again
     ipadnsrecord:
@@ -27,7 +27,7 @@
       zone_name: "{{ testzone }}"
       a_rec: 192.168.122.101
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that dns A records for 'host01' are present
     ipadnsrecord:
@@ -39,7 +39,7 @@
       - 192.168.122.102
       - 192.168.122.103
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that dns A records for 'host01' are present, again
     ipadnsrecord:
@@ -51,7 +51,7 @@
       - 192.168.122.102
       - 192.168.122.103
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that dns A records for 'host01' are absent
     ipadnsrecord:
@@ -63,7 +63,7 @@
       - 192.168.122.102
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that dns A records for 'host01' are absent, again
     ipadnsrecord:
@@ -75,7 +75,7 @@
       - 192.168.122.102
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   ####
 
@@ -86,7 +86,7 @@
       zone_name: "{{ testzone }}"
       aaaa_rec: fd00::0001
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that dns AAAA record for 'host01' is present, again
     ipadnsrecord:
@@ -95,7 +95,7 @@
       zone_name: "{{ testzone }}"
       aaaa_rec: fd00::0001
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that dns AAAA records for 'host01' are present
     ipadnsrecord:
@@ -107,7 +107,7 @@
       - fd00::0011
       - fd00::0021
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that dns AAAAA records for 'host01' are present, again
     ipadnsrecord:
@@ -119,7 +119,7 @@
       - fd00::0011
       - fd00::0021
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure that dns AAAAA records for 'host01' are absent
     ipadnsrecord:
@@ -131,7 +131,7 @@
       - fd00::0011
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure that dns AAAAA records for 'host01' are absent, again
     ipadnsrecord:
@@ -143,7 +143,7 @@
       - fd00::0011
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # Cleanup
   - name: Cleanup test environment.
diff --git a/tests/dnszone/test_dnszone.yml b/tests/dnszone/test_dnszone.yml
index 1c2997485eabdf74a21019e415ec52c88934e315..d7860aae77b9c51b13732a1665463ab5558a5732 100644
--- a/tests/dnszone/test_dnszone.yml
+++ b/tests/dnszone/test_dnszone.yml
@@ -17,7 +17,7 @@
       name: testzone.local
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure zone is present, again.
     ipadnszone:
@@ -25,7 +25,7 @@
       name: testzone.local
       state: present
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure zone is disabled.
     ipadnszone:
@@ -33,7 +33,7 @@
       name: testzone.local
       state: disabled
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure zone is disabled, again.
     ipadnszone:
@@ -41,7 +41,7 @@
       name: testzone.local
       state: disabled
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure zone is enabled.
     ipadnszone:
@@ -49,7 +49,7 @@
       name: testzone.local
       state: enabled
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure zone is enabled, again.
     ipadnszone:
@@ -57,7 +57,7 @@
       name: testzone.local
       state: enabled
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure forward_policy is none.
     ipadnszone:
@@ -65,7 +65,7 @@
       name: testzone.local
       forward_policy: none
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure forward_policy is none, again.
     ipadnszone:
@@ -73,7 +73,7 @@
       name: testzone.local
       forward_policy: none
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure forward_policy is first.
     ipadnszone:
@@ -81,7 +81,7 @@
       name: testzone.local
       forward_policy: first
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure forward_policy is first, again.
     ipadnszone:
@@ -89,7 +89,7 @@
       name: testzone.local
       forward_policy: first
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure first forwarder is set.
     ipadnszone:
@@ -99,7 +99,7 @@
         - ip_address: 8.8.8.8
           port: 53
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure first and second forwarder are set.
     ipadnszone:
@@ -110,7 +110,7 @@
           port: 53
         - ip_address: 2001:4860:4860::8888
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure first and second forwarder are set, again.
     ipadnszone:
@@ -121,7 +121,7 @@
           port: 53
         - ip_address: 2001:4860:4860::8888
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure only second forwarder is set.
     ipadnszone:
@@ -130,14 +130,14 @@
       forwarders:
         - ip_address: 2001:4860:4860::8888
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Nothing changes.
     ipadnszone:
       ipaadmin_password: SomeADMINpassword
       name: testzone.local
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure no forwarders are set.
     ipadnszone:
@@ -145,22 +145,49 @@
       name: testzone.local
       forwarders: []
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Create zones test1
     ipadnszone:
       ipaadmin_password: SomeADMINpassword
       name: test1.testzone.local
+    register: result
+    failed_when: not result.changed or result.failed
+
+  - name: Create zones test1, again
+    ipadnszone:
+      ipaadmin_password: SomeADMINpassword
+      name: test1.testzone.local
+    register: result
+    failed_when: result.changed or result.failed
 
   - name: Create zones test2
     ipadnszone:
       ipaadmin_password: SomeADMINpassword
       name: test2.testzone.local
+    register: result
+    failed_when: not result.changed or result.failed
+
+  - name: Create zones test2, again
+    ipadnszone:
+      ipaadmin_password: SomeADMINpassword
+      name: test2.testzone.local
+    register: result
+    failed_when: result.changed or result.failed
 
   - name: Create zones test3
     ipadnszone:
       ipaadmin_password: SomeADMINpassword
       name: test3.testzone.local
+    register: result
+    failed_when: not result.changed or result.failed
+
+  - name: Create zones test3, again
+    ipadnszone:
+      ipaadmin_password: SomeADMINpassword
+      name: test3.testzone.local
+    register: result
+    failed_when: result.changed or result.failed
 
   - name: Ensure multiple zones are absent
     ipadnszone:
@@ -171,7 +198,7 @@
         - test3.testzone.local
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure multiple zones are absent, again
     ipadnszone:
@@ -182,7 +209,7 @@
         - test3.testzone.local
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # Teardown
   - name: Teardown testing environment
diff --git a/tests/dnszone/test_dnszone_mod.yml b/tests/dnszone/test_dnszone_mod.yml
index 80e70c6a89553bd59e88a1ab5e3c591ec6b2bf20..7ab725e4149a4d47560d529699c77961ecf53f1a 100644
--- a/tests/dnszone/test_dnszone_mod.yml
+++ b/tests/dnszone/test_dnszone_mod.yml
@@ -111,7 +111,7 @@
       nsec3param_rec: "1 7 100 abcd"
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Set serial to 1234, again.
     ipadnszone:
@@ -119,7 +119,7 @@
       name: testzone.local
       serial: 1234
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Set different nsec3param_rec.
     ipadnszone:
@@ -127,7 +127,7 @@
       name: testzone.local
       nsec3param_rec: "2 8 200 abcd"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Set same nsec3param_rec.
     ipadnszone:
@@ -135,7 +135,7 @@
       name: testzone.local
       nsec3param_rec: "2 8 200 abcd"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Set default_ttl to 1200
     ipadnszone:
@@ -143,7 +143,7 @@
       name: testzone.local
       default_ttl: 1200
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Set default_ttl to 1200, again
     ipadnszone:
@@ -151,7 +151,7 @@
       name: testzone.local
       default_ttl: 1200
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Set ttl to 900
     ipadnszone:
@@ -159,7 +159,7 @@
       name: testzone.local
       ttl: 900
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Set ttl to 900, again
     ipadnszone:
@@ -167,7 +167,7 @@
       name: testzone.local
       ttl: 900
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Set minimum to 1000
     ipadnszone:
@@ -175,7 +175,7 @@
       name: testzone.local
       minimum: 1000
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Set minimum to 1000, again
     ipadnszone:
@@ -183,7 +183,7 @@
       name: testzone.local
       minimum: 1000
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Set expire to 1209601
     ipadnszone:
@@ -191,7 +191,7 @@
       name: testzone.local
       expire: 1209601
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Set expire to 1209601, again
     ipadnszone:
@@ -199,7 +199,7 @@
       name: testzone.local
       expire: 1209601
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Set retry to 1200.
     ipadnszone:
@@ -207,7 +207,7 @@
       name: testzone.local
       retry: 1200
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Set retry to 1200, again.
     ipadnszone:
@@ -215,7 +215,7 @@
       name: testzone.local
       retry: 1200
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Set refresh to 4000.
     ipadnszone:
@@ -223,7 +223,7 @@
       name: testzone.local
       refresh: 4000
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Set refresh to 4000, again.
     ipadnszone:
@@ -231,7 +231,7 @@
       name: testzone.local
       refresh: 4000
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Set serial to 12345.
     ipadnszone:
@@ -239,7 +239,7 @@
       name: testzone.local
       serial: 12345
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Set serial to 12345, again.
     ipadnszone:
@@ -247,7 +247,7 @@
       name: testzone.local
       serial: 12345
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Set dnssec to false.
     ipadnszone:
@@ -255,7 +255,7 @@
       name: testzone.local
       dnssec: false
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Set dnssec to false, again.
     ipadnszone:
@@ -263,7 +263,7 @@
       name: testzone.local
       dnssec: false
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Set allow_sync_ptr to false.
     ipadnszone:
@@ -271,7 +271,7 @@
       name: testzone.local
       allow_sync_ptr: false
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Set allow_sync_ptr to false, again.
     ipadnszone:
@@ -279,7 +279,7 @@
       name: testzone.local
       allow_sync_ptr: false
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Set dynamic_update to false.
     ipadnszone:
@@ -287,7 +287,7 @@
       name: testzone.local
       dynamic_update: false
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Set dynamic_update to false, again.
     ipadnszone:
@@ -295,7 +295,7 @@
       name: testzone.local
       dynamic_update: false
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Update allow_transfer.
     ipadnszone:
@@ -306,7 +306,7 @@
         - 2.2.2.2
         - 3.3.3.3
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Update allow_transfer, again.
     ipadnszone:
@@ -317,7 +317,7 @@
         - 2.2.2.2
         - 3.3.3.3
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Remove allow transfer.
     ipadnszone:
@@ -325,7 +325,7 @@
       name: testzone.local
       allow_transfer: []
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Remove allow transfer, again.
     ipadnszone:
@@ -333,7 +333,7 @@
       name: testzone.local
       allow_transfer: []
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Update allow_query.
     ipadnszone:
@@ -344,7 +344,7 @@
         - 2.2.2.2
         - 3.3.3.3
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Update allow_query, again.
     ipadnszone:
@@ -355,7 +355,7 @@
         - 2.2.2.2
         - 3.3.3.3
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure allow query is empty.
     ipadnszone:
@@ -363,7 +363,7 @@
       name: testzone.local
       allow_query: []
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure allow query is empty, again.
     ipadnszone:
@@ -371,7 +371,7 @@
       name: testzone.local
       allow_query: []
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Update admin email.
     ipadnszone:
@@ -379,7 +379,7 @@
       name: testzone.local
       admin_email: admin2@example.com
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Update admin email, again.
     ipadnszone:
@@ -387,7 +387,7 @@
       name: testzone.local
       admin_email: admin2@example.com
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # Teardown
   - name: Teardown testing environment
diff --git a/tests/dnszone/test_dnszone_name_from_ip.yml b/tests/dnszone/test_dnszone_name_from_ip.yml
index fb1086d652c834b4b809f0fcaa516fe7493c1692..62295742106f69d4fffb83437d044f770f7c7920 100644
--- a/tests/dnszone/test_dnszone_name_from_ip.yml
+++ b/tests/dnszone/test_dnszone_name_from_ip.yml
@@ -38,7 +38,7 @@
       name_from_ip: 192.0.2.3/24
       default_ttl: 1234
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Modify existing zone, using `name_from_ip`, again.
     ipadnszone:
@@ -70,14 +70,14 @@
       ipaadmin_password: SomeADMINpassword
       name_from_ip: fd00::0001
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure second ipv6 zone exists for reverse IPv6.
     ipadnszone:
       ipaadmin_password: SomeADMINpassword
       name_from_ip: 2001:db8:cafe:1::1
     register: ipv6_sec_zone
-    failed_when: not ipv6_sec_zone.changed or ipv6_zone.failed
+    failed_when: not ipv6_sec_zone.changed or ipv6_zone.failed or ipv6_sec_zone.failed
 
   - name: Ensure second ipv6 zone was created.
     ipadnszone:
@@ -91,7 +91,7 @@
       ipaadmin_password: SomeADMINpassword
       name_from_ip: 2001:db8:cafe:1::1
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # Teardown
   - name: Teardown testing environment
diff --git a/tests/group/test_group.yml b/tests/group/test_group.yml
index 28df3a5ace4c072639f208fdd75699571d008538..855443bd4d64c369f83c3a8b9293ddda03a36d7c 100644
--- a/tests/group/test_group.yml
+++ b/tests/group/test_group.yml
@@ -31,49 +31,49 @@
         first: user3
         last: Last
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group1 is present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: group1
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group1 is present again
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: group1
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure group2 is present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: group2
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group2 is present again
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: group2
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure group3 is present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: group3
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group3 is present again
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: group3
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure groups group2 and group3 are present in group group1
     ipagroup:
@@ -84,7 +84,7 @@
       - group3
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure groups group2 and group3 are present in group group1 again
     ipagroup:
@@ -95,7 +95,7 @@
       - group3
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure group3 ia present in group group1
     ipagroup:
@@ -105,7 +105,7 @@
       - group3
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure users user1, user2 and user3 are present in group group1
     ipagroup:
@@ -117,7 +117,7 @@
       - user3
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure users user1, user2 and user3 are present in group group1 again
     ipagroup:
@@ -129,7 +129,7 @@
       - user3
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   #- ipagroup:
   #    ipaadmin_password: SomeADMINpassword
@@ -147,7 +147,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure group group4 is absent
     ipagroup:
@@ -155,7 +155,7 @@
       name: group4
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure group group3, group2 and group1 are absent
     ipagroup:
@@ -163,7 +163,7 @@
       name: group3,group2,group1
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure users user1, user2 and user3 are absent
     ipauser:
@@ -171,5 +171,5 @@
       name: user1,user2,user3
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
diff --git a/tests/group/test_group_membermanager.yml b/tests/group/test_group_membermanager.yml
index f3d58812ac10bd77d5d9491b549cbb92bbcb3af1..4105e75de22541c00b81af19f5954a72fbc47837 100644
--- a/tests/group/test_group_membermanager.yml
+++ b/tests/group/test_group_membermanager.yml
@@ -32,28 +32,28 @@
             first: manageruser2
             last: Last2
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure testgroup is present
         ipagroup:
           ipaadmin_password: SomeADMINpassword
           name: testgroup
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure managergroup1 is present
         ipagroup:
           ipaadmin_password: SomeADMINpassword
           name: managergroup1
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure managergroup2 is present
         ipagroup:
           ipaadmin_password: SomeADMINpassword
           name: managergroup2
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager user1 is present for testgroup
         ipagroup:
@@ -61,7 +61,7 @@
           name: testgroup
           membermanager_user: manageruser1
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager user1 is present for testgroup again
         ipagroup:
@@ -69,7 +69,7 @@
           name: testgroup
           membermanager_user: manageruser1
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure membermanager group1 is present for testgroup
         ipagroup:
@@ -77,7 +77,7 @@
           name: testgroup
           membermanager_group: managergroup1
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager group1 is present for testgroup again
         ipagroup:
@@ -85,7 +85,7 @@
           name: testgroup
           membermanager_group: managergroup1
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure membermanager user2 and group2 members are present for testgroup
         ipagroup:
@@ -95,7 +95,7 @@
           membermanager_group: managergroup2
           action: member
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager user2 and group2 members are present for testgroup again
         ipagroup:
@@ -105,7 +105,7 @@
           membermanager_group: managergroup2
           action: member
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure membermanager user and group members are present for testgroup again
         ipagroup:
@@ -115,7 +115,7 @@
           membermanager_group: managergroup1,managergroup2
           action: member
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure membermanager user1 and group1 members are absent for testgroup
         ipagroup:
@@ -126,7 +126,7 @@
           action: member
           state: absent
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager user1 and group1 members are absent for testgroup again
         ipagroup:
@@ -137,7 +137,7 @@
           action: member
           state: absent
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure membermanager user1 and group1 members are present for testgroup
         ipagroup:
@@ -147,7 +147,7 @@
           membermanager_group: managergroup1
           action: member
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager user1 and group1 members are present for testgroup again
         ipagroup:
@@ -157,7 +157,7 @@
           membermanager_group: managergroup1
           action: member
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure membermanager user and group members are absent for testgroup
         ipagroup:
@@ -168,7 +168,7 @@
           action: member
           state: absent
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager user and group members are absent for testgroup again
         ipagroup:
@@ -179,7 +179,7 @@
           action: member
           state: absent
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure user manangeruser1 and manageruser2 is absent
         ipauser:
@@ -187,7 +187,7 @@
           name: manageruser1,manageruser2
           state: absent
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure unknown membermanager_user member failure
         ipagroup:
@@ -196,7 +196,7 @@
           membermanager_user: unknown_user
           action: member
         register: result
-        failed_when: result.changed or "no such entry" not in result.msg
+        failed_when: result.changed or "no such entry" not in result.msg or not result.failed
 
       - name: Ensure group testgroup, managergroup1 and managergroup2 are absent
         ipagroup:
@@ -204,6 +204,6 @@
           name: testgroup,managergroup1,managergroup2
           state: absent
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
     when: ipa_version is version('4.8.4', '>=')
diff --git a/tests/hbacrule/test_hbacrule.yml b/tests/hbacrule/test_hbacrule.yml
index e0dc3b8ef9943b7dd4ce1c75707313310e8ff2a3..6e1d4aef7c14b448c220d90c2ec03e87f7cebde3 100644
--- a/tests/hbacrule/test_hbacrule.yml
+++ b/tests/hbacrule/test_hbacrule.yml
@@ -66,35 +66,35 @@
       - name: "{{ 'testhost04.' + ipaserver_domain }}"
         force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group testhostgroup01 is present
     ipahostgroup:
       ipaadmin_password: SomeADMINpassword
       name: testhostgroup01
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group testhostgroup02 is present
     ipahostgroup:
       ipaadmin_password: SomeADMINpassword
       name: testhostgroup02
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group testhostgroup03 is present
     ipahostgroup:
       ipaadmin_password: SomeADMINpassword
       name: testhostgroup03
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group testhostgroup04 is present
     ipahostgroup:
       ipaadmin_password: SomeADMINpassword
       name: testhostgroup04
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure testusers are present
     ipauser:
@@ -113,91 +113,91 @@
         first: test
         last: user04
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure user group testgroup01 is present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: testgroup01
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure user group testgroup02 is present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: testgroup02
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure user group testgroup03 is present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: testgroup03
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure user group testgroup04 is present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: testgroup04
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Service testhbacsvc01 is present
     ipahbacsvc:
       ipaadmin_password: SomeADMINpassword
       name: testhbacsvc01
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Service testhbacsvc02 is present
     ipahbacsvc:
       ipaadmin_password: SomeADMINpassword
       name: testhbacsvc02
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Service testhbacsvc03 is present
     ipahbacsvc:
       ipaadmin_password: SomeADMINpassword
       name: testhbacsvc03
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Service testhbacsvc04 is present
     ipahbacsvc:
       ipaadmin_password: SomeADMINpassword
       name: testhbacsvc04
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Service Group testhbacsvcgroup01 is present
     ipahbacsvcgroup:
       ipaadmin_password: SomeADMINpassword
       name: testhbacsvcgroup01
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Service Group testhbacsvcgroup02 is present
     ipahbacsvcgroup:
       ipaadmin_password: SomeADMINpassword
       name: testhbacsvcgroup02
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Service Group testhbacsvcgroup03 is present
     ipahbacsvcgroup:
       ipaadmin_password: SomeADMINpassword
       name: testhbacsvcgroup03
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Service Group testhbacsvcgroup04 is present
     ipahbacsvcgroup:
       ipaadmin_password: SomeADMINpassword
       name: testhbacsvcgroup04
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 is absent
     ipahbacrule:
@@ -212,14 +212,14 @@
       ipaadmin_password: SomeADMINpassword
       name: hbacrule01
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC rule hbacrule01 is present again
     ipahbacrule:
       ipaadmin_password: SomeADMINpassword
       name: hbacrule01
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # CHANGE HBACRULE WITH ALL MEMBERS
 
@@ -236,7 +236,7 @@
       hbacsvc: testhbacsvc01,testhbacsvc02
       hbacsvcgroup: testhbacsvcgroup01,testhbacsvcgroup02
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC rule hbacrule01 is present with hosts, hostgroups, users, groups, hbassvcs and hbacsvcgroups again
     ipahbacrule:
@@ -251,7 +251,7 @@
       hbacsvc: testhbacsvc01,testhbacsvc02
       hbacsvcgroup: testhbacsvcgroup01,testhbacsvcgroup02
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # REMOVE MEMBERS ONE BY ONE
 
@@ -265,7 +265,7 @@
       state: absent
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 host members are absent again
     ipahbacrule:
@@ -277,7 +277,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 hostgroup members are absent
     ipahbacrule:
@@ -287,7 +287,7 @@
       state: absent
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 hostgroup members are absent again
     ipahbacrule:
@@ -297,7 +297,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 user members are absent
     ipahbacrule:
@@ -307,7 +307,7 @@
       state: absent
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 user members are absent again
     ipahbacrule:
@@ -317,7 +317,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 user group members are absent
     ipahbacrule:
@@ -327,7 +327,7 @@
       state: absent
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 user group members are absent again
     ipahbacrule:
@@ -337,7 +337,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 hbacsvc members are absent
     ipahbacrule:
@@ -347,7 +347,7 @@
       state: absent
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 hbacsvc members are absent again
     ipahbacrule:
@@ -357,7 +357,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 hbacsvcgroup members are absent
     ipahbacrule:
@@ -367,7 +367,7 @@
       state: absent
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 hbacsvcgroup members are absent again
     ipahbacrule:
@@ -377,7 +377,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # ADD MEMBERS BACK
 
@@ -390,7 +390,7 @@
       - "{{ 'testhost02.' + ipaserver_domain }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 host members are present again
     ipahbacrule:
@@ -401,7 +401,7 @@
       - "{{ 'testhost02.' + ipaserver_domain }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 hostgroup members are present
     ipahbacrule:
@@ -410,7 +410,7 @@
       hostgroup: testhostgroup01,testhostgroup02
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 hostgroup members are present again
     ipahbacrule:
@@ -419,7 +419,7 @@
       hostgroup: testhostgroup01,testhostgroup02
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 user members are present
     ipahbacrule:
@@ -428,7 +428,7 @@
       user: testuser01,testuser02
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 user members are present again
     ipahbacrule:
@@ -437,7 +437,7 @@
       user: testuser01,testuser02
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 user group members are present
     ipahbacrule:
@@ -446,7 +446,7 @@
       group: testgroup01,testgroup02
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 user group members are present again
     ipahbacrule:
@@ -455,7 +455,7 @@
       group: testgroup01,testgroup02
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 hbacsvc members are present
     ipahbacrule:
@@ -464,7 +464,7 @@
       hbacsvc: testhbacsvc01,testhbacsvc02
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 hbacsvc members are present again
     ipahbacrule:
@@ -473,7 +473,7 @@
       hbacsvc: testhbacsvc01,testhbacsvc02
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 hbacsvcgroup members are present
     ipahbacrule:
@@ -482,7 +482,7 @@
       hbacsvcgroup: testhbacsvcgroup01,testhbacsvcgroup02
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure test HBAC rule hbacrule01 hbacsvcgroup members are present again
     ipahbacrule:
@@ -491,7 +491,7 @@
       hbacsvcgroup: testhbacsvcgroup01,testhbacsvcgroup02
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # CHANGE TO DIFFERENT MEMBERS
 
@@ -508,7 +508,7 @@
       hbacsvc: testhbacsvc03,testhbacsvc04
       hbacsvcgroup: testhbacsvcgroup03,testhbacsvcgroup04
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC rule hbacrule01 is present with different hosts, hostgroups, users, groups, hbassvcs and hbacsvcgroups again
     ipahbacrule:
@@ -523,7 +523,7 @@
       hbacsvc: testhbacsvc03,testhbacsvc04
       hbacsvcgroup: testhbacsvcgroup03,testhbacsvcgroup04
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # ENSURE OLD TEST MEMBERS ARE ABSENT
 
@@ -542,7 +542,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # ENSURE NEW TEST MEMBERS ARE ABSENT
 
@@ -561,7 +561,7 @@
       state: absent
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC rule hbacrule01 members are absent again
     ipahbacrule:
@@ -578,7 +578,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # CLEANUP TEST ITEMS
 
diff --git a/tests/hbacrule/test_hbacrule_categories.yml b/tests/hbacrule/test_hbacrule_categories.yml
index 67bc9934978e108b5c7747bc8d28f54a184431e1..f21109552d6a3c15791b82b1d9d99e65a03963e9 100644
--- a/tests/hbacrule/test_hbacrule_categories.yml
+++ b/tests/hbacrule/test_hbacrule_categories.yml
@@ -19,7 +19,7 @@
       name: testrule
       usercategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC rule is present, with usercategory 'all', again.
     ipahbacrule:
@@ -27,7 +27,7 @@
       name: testrule
       usercategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure HBAC rule is present, with no usercategory.
     ipahbacrule:
@@ -35,7 +35,7 @@
       name: testrule
       usercategory: ""
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC rule is present, with no usercategory, again.
     ipahbacrule:
@@ -43,7 +43,7 @@
       name: testrule
       usercategory: ""
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure HBAC rule is present, with hostcategory 'all'
     ipahbacrule:
@@ -51,7 +51,7 @@
       name: testrule
       hostcategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC rule is present, with hostcategory 'all', again.
     ipahbacrule:
@@ -59,7 +59,7 @@
       name: testrule
       hostcategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure HBAC rule is present, with no hostcategory.
     ipahbacrule:
@@ -67,7 +67,7 @@
       name: testrule
       hostcategory: ""
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC rule is present, with no hostcategory, again.
     ipahbacrule:
@@ -75,7 +75,7 @@
       name: testrule
       hostcategory: ""
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure HBAC rule is present, with servicecategory 'all'
     ipahbacrule:
@@ -83,7 +83,7 @@
       name: testrule
       servicecategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC rule is present, with servicecategory 'all', again.
     ipahbacrule:
@@ -91,7 +91,7 @@
       name: testrule
       servicecategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure HBAC rule is present, with no servicecategory.
     ipahbacrule:
@@ -99,7 +99,7 @@
       name: testrule
       servicecategory: ""
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC rule is present, with no servicecategory, again.
     ipahbacrule:
@@ -107,7 +107,7 @@
       name: testrule
       servicecategory: ""
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure `user` cannot be added if usercategory is `all`.
     ipahbacrule:
diff --git a/tests/hbacsvc/test_hbacsvc.yml b/tests/hbacsvc/test_hbacsvc.yml
index 87a6bbd5fe880330f5a9fa8797a11a164a5fdccb..c91cf39b0fba8b0e6952ccf024bf9b13dc9c89e6 100644
--- a/tests/hbacsvc/test_hbacsvc.yml
+++ b/tests/hbacsvc/test_hbacsvc.yml
@@ -16,14 +16,14 @@
       ipaadmin_password: SomeADMINpassword
       name: http
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Service for http is present again
     ipahbacsvc:
       ipaadmin_password: SomeADMINpassword
       name: http
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure HBAC Service for tftp is present
     ipahbacsvc:
@@ -31,7 +31,7 @@
       name: tftp
       description: TFTP service
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Service for tftp is present again
     ipahbacsvc:
@@ -39,7 +39,7 @@
       name: tftp
       description: TFTP service
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure HBAC Services for http and tftp are absent
     ipahbacsvc:
@@ -47,7 +47,7 @@
       name: http,tftp
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Services for http and tftp are absent again
     ipahbacsvc:
@@ -55,4 +55,4 @@
       name: http,tftp
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
diff --git a/tests/hbacsvcgroup/test_hbacsvcgroup.yml b/tests/hbacsvcgroup/test_hbacsvcgroup.yml
index 853efa2993ca80ebc7e2e26a8feccf54bcbe0de2..d0cd02cd49a59c19a73ad0beab58bf273ab317bb 100644
--- a/tests/hbacsvcgroup/test_hbacsvcgroup.yml
+++ b/tests/hbacsvcgroup/test_hbacsvcgroup.yml
@@ -21,14 +21,14 @@
       ipaadmin_password: SomeADMINpassword
       name: login
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Service Group login is present again
     ipahbacsvcgroup:
       ipaadmin_password: SomeADMINpassword
       name: login
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure HBAC Service sshd is present in HBAC Service Group login
     ipahbacsvcgroup:
@@ -38,7 +38,7 @@
       - sshd
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Service sshd is present in HBAC Service Group login again
     ipahbacsvcgroup:
@@ -48,7 +48,7 @@
       - sshd
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure HBAC Services sshd and foo are absent in HBAC Service Group login
     ipahbacsvcgroup:
@@ -60,7 +60,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Services sshd and foo are absent in HBAC Service Group login again
     ipahbacsvcgroup:
@@ -72,7 +72,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure HBAC Service Group login is absent
     ipahbacsvcgroup:
@@ -80,7 +80,7 @@
       name: login
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure HBAC Service Group login is absent again
     ipahbacsvcgroup:
@@ -88,4 +88,4 @@
       name: login
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
diff --git a/tests/host/certificate/test_host_certificate.yml b/tests/host/certificate/test_host_certificate.yml
index 1feb66b57ff985b0e60a1af908e9c3e7cc3b3abd..33d316d98cc37fc2932960ee7a0a0a6913cdcd95 100644
--- a/tests/host/certificate/test_host_certificate.yml
+++ b/tests/host/certificate/test_host_certificate.yml
@@ -31,7 +31,7 @@
       name: "{{ 'test.' + ipaserver_domain }}"
       force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host test cert members present
     ipahost:
@@ -43,7 +43,7 @@
         - "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host test cert members present again
     ipahost:
@@ -55,7 +55,7 @@
         - "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host test cert members absent
     ipahost:
@@ -68,7 +68,7 @@
       state: absent
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host test cert members absent again
     ipahost:
@@ -81,7 +81,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host test absent
     ipahost:
@@ -89,7 +89,7 @@
       name: "{{ 'test.' + ipaserver_domain }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host test absent again
     ipahost:
@@ -97,7 +97,7 @@
       name: "{{ 'test.' + ipaserver_domain }}"
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Remove certificate files.
     shell:
diff --git a/tests/host/certificate/test_hosts_certificate.yml b/tests/host/certificate/test_hosts_certificate.yml
index 00940f3c76bab4303bcbab025414ae4a449db174..a2b7eca0a8d24bf1caf9adc5f805d1a2af4d88d2 100644
--- a/tests/host/certificate/test_hosts_certificate.yml
+++ b/tests/host/certificate/test_hosts_certificate.yml
@@ -23,7 +23,7 @@
       - name: "{{ 'test.' + ipaserver_domain }}"
         force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Generate self-signed certificates.
     shell:
@@ -46,7 +46,7 @@
         - "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host test cert members present again
     ipahost:
@@ -59,7 +59,7 @@
         - "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host test cert members absent
     ipahost:
@@ -73,7 +73,7 @@
       state: absent
       action: member
     #register: result
-    #failed_when: not result.changed
+    #failed_when: not result.changed or result.failed
 
   - name: Host test cert members absent again
     ipahost:
@@ -87,7 +87,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host test absent
     ipahost:
@@ -96,7 +96,7 @@
       - name: "{{ 'test.' + ipaserver_domain }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Remove certificate files.
     shell:
diff --git a/tests/host/test_host.yml b/tests/host/test_host.yml
index e04105b94cbb132d557778b51d3acc728ded2715..3b186525a2c86d34db2e0be28bfb7f6421074227 100644
--- a/tests/host/test_host.yml
+++ b/tests/host/test_host.yml
@@ -44,7 +44,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present again
     ipahost:
@@ -54,7 +54,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host2_fqdn }}" present
     ipahost:
@@ -64,7 +64,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host2_fqdn }}" present again
     ipahost:
@@ -74,7 +74,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host3_fqdn }}" present
     ipahost:
@@ -84,7 +84,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host3_fqdn }}" present again
     ipahost:
@@ -94,7 +94,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host4_fqdn }}" present
     ipahost:
@@ -104,7 +104,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host4_fqdn }}" present again
     ipahost:
@@ -114,7 +114,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host5_fqdn }}" present
     ipahost:
@@ -124,7 +124,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host5_fqdn }}" present again
     ipahost:
@@ -134,7 +134,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host6_fqdn }}" present
     ipahost:
@@ -144,7 +144,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host6_fqdn }}" present again
     ipahost:
@@ -154,7 +154,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # disabled can only be checked with enabled hosts, all hosts above are
   # not enabled.
@@ -170,7 +170,7 @@
   #    - "{{ host6_fqdn }}"
   #    state: disabled
   #  register: result
-  #  failed_when: not result.changed
+  #  failed_when: not result.changed or result.failed
   #
   #- name: Hosts host1..host6 disabled again
   #  ipahost:
@@ -184,7 +184,7 @@
   #    - "{{ host6_fqdn }}"
   #    state: disabled
   #  register: result
-  #  failed_when: result.changed
+  #  failed_when: result.changed or result.failed
 
   - name: Hosts host1..host6 absent
     ipahost:
@@ -199,7 +199,7 @@
       update_dns: yes
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Hosts host1..host6 absent again
     ipahost:
@@ -214,5 +214,5 @@
       update_dns: yes
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
diff --git a/tests/host/test_host_allow_create_keytab.yml b/tests/host/test_host_allow_create_keytab.yml
index 358a6780828a2751af9473ada65e1766b95a7665..b5242422586b587b179b893ca26c8fee886b1cb0 100644
--- a/tests/host/test_host_allow_create_keytab.yml
+++ b/tests/host/test_host_allow_create_keytab.yml
@@ -58,7 +58,7 @@
       - name: "{{ host3_fqdn }}"
         force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group hostgroup1 present
     ipahostgroup:
@@ -66,7 +66,7 @@
       name: hostgroup1
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group hostgroup2 present
     ipahostgroup:
@@ -74,7 +74,7 @@
       name: hostgroup2
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure users user1 and user2 present
     ipauser:
@@ -87,21 +87,21 @@
         first: First2
         last: Last2
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group1 present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: group1
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group2 present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: group2
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... present with allow_create_keytab users,groups,hosts and hostgroups
     ipahost:
@@ -121,7 +121,7 @@
       - hostgroup2
       force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... present with allow_create_keytab users,groups,hosts and hostgroups again
     ipahost:
@@ -141,7 +141,7 @@
       - hostgroup2
       force: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host host1... absent
     ipahost:
@@ -156,7 +156,7 @@
       name: "{{ host1_fqdn }}"
       force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... ensure allow_create_keytab users,groups,hosts and hostgroups present
     ipahost:
@@ -176,7 +176,7 @@
       - hostgroup2
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... ensure allow_create_keytab users,groups,hosts and hostgroups present again
     ipahost:
@@ -196,7 +196,7 @@
       - hostgroup2
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host host1... ensure allow_create_keytab users,groups,hosts and hostgroups absent
     ipahost:
@@ -217,7 +217,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... ensure allow_create_keytab users,groups,hosts and hostgroups absent again
     ipahost:
@@ -238,7 +238,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host host1..., host2... and host3... absent
     ipahost:
@@ -249,7 +249,7 @@
       - "{{ host3_fqdn }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-groups hostgroup1 and hostgroup2 absent
     ipahostgroup:
@@ -257,7 +257,7 @@
       name: hostgroup1,hostgroup2
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure users user1 and user2 absent
     ipauser:
@@ -267,7 +267,7 @@
       - name: user2
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group1 and group2 absent
     ipagroup:
@@ -275,4 +275,4 @@
       name: group1,group2
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
diff --git a/tests/host/test_host_allow_retrieve_keytab.yml b/tests/host/test_host_allow_retrieve_keytab.yml
index c5eba3770e99c8d544c21a76e63492dde5487b73..f38ea30220dbf77c35eb01ba864c3780c76ec824 100644
--- a/tests/host/test_host_allow_retrieve_keytab.yml
+++ b/tests/host/test_host_allow_retrieve_keytab.yml
@@ -58,7 +58,7 @@
       - name: "{{ host3_fqdn }}"
         force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group hostgroup1 present
     ipahostgroup:
@@ -66,7 +66,7 @@
       name: hostgroup1
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group hostgroup2 present
     ipahostgroup:
@@ -74,7 +74,7 @@
       name: hostgroup2
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure users user1 and user2 present
     ipauser:
@@ -87,21 +87,21 @@
         first: First2
         last: Last2
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group1 present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: group1
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group2 present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: group2
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... present with allow_retrieve_keytab users,groups,hosts and hostgroups
     ipahost:
@@ -121,7 +121,7 @@
       - hostgroup2
       force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... present with allow_retrieve_keytab users,groups,hosts and hostgroups again
     ipahost:
@@ -141,7 +141,7 @@
       - hostgroup2
       force: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host host1... absent
     ipahost:
@@ -156,7 +156,7 @@
       name: "{{ host1_fqdn }}"
       force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... ensure allow_retrieve_keytab users,groups,hosts and hostgroups present
     ipahost:
@@ -176,7 +176,7 @@
       - hostgroup2
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... ensure allow_retrieve_keytab users,groups,hosts and hostgroups present again
     ipahost:
@@ -196,7 +196,7 @@
       - hostgroup2
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host host1... ensure allow_retrieve_keytab users,groups,hosts and hostgroups absent
     ipahost:
@@ -217,7 +217,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... ensure allow_retrieve_keytab users,groups,hosts and hostgroups absent again
     ipahost:
@@ -238,7 +238,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host host1..., host2... and host3... absent
     ipahost:
@@ -249,7 +249,7 @@
       - "{{ host3_fqdn }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-groups hostgroup1 and hostgroup2 absent
     ipahostgroup:
@@ -257,7 +257,7 @@
       name: hostgroup1,hostgroup2
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure users user1 and user2 absent
     ipauser:
@@ -267,7 +267,7 @@
       - name: user2
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group1 and group2 absent
     ipagroup:
@@ -275,4 +275,4 @@
       name: group1,group2
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
diff --git a/tests/host/test_host_bool_params.yml b/tests/host/test_host_bool_params.yml
index e685fbea6d9fe5f94e32009842ed9ccb4549c432..cfb2f653c4b0ba78714f65bed5d41f2534a76e00 100644
--- a/tests/host/test_host_bool_params.yml
+++ b/tests/host/test_host_bool_params.yml
@@ -30,7 +30,7 @@
       ok_as_delegate: yes
       ok_to_auth_as_delegate: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present with requires_pre_auth, ok_as_delegate and ok_to_auth_as_delegate again
     ipahost:
@@ -40,7 +40,7 @@
       ok_as_delegate: yes
       ok_to_auth_as_delegate: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present with requires_pre_auth, ok_as_delegate and ok_to_auth_as_delegate set to no
     ipahost:
@@ -50,7 +50,7 @@
       ok_as_delegate: no
       ok_to_auth_as_delegate: no
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present with requires_pre_auth, ok_as_delegate and ok_to_auth_as_delegate set to no again
     ipahost:
@@ -60,7 +60,7 @@
       ok_as_delegate: no
       ok_to_auth_as_delegate: no
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present with requires_pre_auth
     ipahost:
@@ -68,7 +68,7 @@
       name: "{{ host1_fqdn }}"
       requires_pre_auth: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present with requires_pre_auth again
     ipahost:
@@ -76,7 +76,7 @@
       name: "{{ host1_fqdn }}"
       requires_pre_auth: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present with ok_as_delegate
     ipahost:
@@ -84,7 +84,7 @@
       name: "{{ host1_fqdn }}"
       ok_as_delegate: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present with ok_as_delegate again
     ipahost:
@@ -92,7 +92,7 @@
       name: "{{ host1_fqdn }}"
       ok_as_delegate: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present with ok_to_auth_as_delegate
     ipahost:
@@ -100,7 +100,7 @@
       name: "{{ host1_fqdn }}"
       ok_to_auth_as_delegate: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present with ok_to_auth_as_delegate again
     ipahost:
@@ -108,7 +108,7 @@
       name: "{{ host1_fqdn }}"
       ok_to_auth_as_delegate: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host absent
     ipahost:
diff --git a/tests/host/test_host_ipaddresses.yml b/tests/host/test_host_ipaddresses.yml
index c9774a604ffd07da89237f70262b0441f18f8843..9ff9a0909b5f5ca46a23d7286df14ab1dd28f595 100644
--- a/tests/host/test_host_ipaddresses.yml
+++ b/tests/host/test_host_ipaddresses.yml
@@ -40,7 +40,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present again
     ipahost:
@@ -52,7 +52,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present again with new IP address
     ipahost:
@@ -66,7 +66,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present again with new IP address again
     ipahost:
@@ -80,7 +80,7 @@
       update_dns: yes
       reverse: no
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" member IPv4 address present
     ipahost:
@@ -89,7 +89,7 @@
       ip_address: "{{ ipv4_prefix + '.201' }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" member IPv4 address present again
     ipahost:
@@ -98,7 +98,7 @@
       ip_address: "{{ ipv4_prefix + '.201' }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" member IPv4 address absent
     ipahost:
@@ -108,7 +108,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" member IPv4 address absent again
     ipahost:
@@ -118,7 +118,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" member IPv6 address present
     ipahost:
@@ -127,7 +127,7 @@
       ip_address: fe80::20c:29ff:fe02:a1b2
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" member IPv6 address present again
     ipahost:
@@ -136,7 +136,7 @@
       ip_address: fe80::20c:29ff:fe02:a1b2
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" member IPv6 address absent
     ipahost:
@@ -146,7 +146,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" member IPv6 address absent again
     ipahost:
@@ -156,6 +156,7 @@
       action: member
       state: absent
     register: result
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" member all ip-addresses absent
     ipahost:
@@ -169,7 +170,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" all member ip-addresses absent again
     ipahost:
@@ -183,7 +184,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Hosts "{{ host1_fqdn }}" and "{{ host2_fqdn }}" present with same IP addresses
     ipahost:
@@ -202,7 +203,7 @@
         - "{{ ipv4_prefix + '.221' }}"
         - fe80::20c:29ff:fe02:a1b4
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Hosts "{{ host1_fqdn }}" and "{{ host2_fqdn }}" present with same IP addresses again
     ipahost:
@@ -221,7 +222,7 @@
         - "{{ ipv4_prefix + '.221' }}"
         - fe80::20c:29ff:fe02:a1b4
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Hosts "{{ host3_fqdn }}" present with same IP addresses
     ipahost:
@@ -234,7 +235,7 @@
         - "{{ ipv4_prefix + '.221' }}"
         - fe80::20c:29ff:fe02:a1b4
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Hosts "{{ host3_fqdn }}" present with same IP addresses again
     ipahost:
@@ -247,7 +248,7 @@
         - "{{ ipv4_prefix + '.221' }}"
         - fe80::20c:29ff:fe02:a1b4
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host3_fqdn }}" present with differnt IP addresses
     ipahost:
@@ -260,7 +261,7 @@
         - "{{ ipv4_prefix + '.121' }}"
         - fe80::20c:29ff:fe02:a1b2
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host3_fqdn }}" present with different IP addresses again
     ipahost:
@@ -273,7 +274,7 @@
         - "{{ ipv4_prefix + '.121' }}"
         - fe80::20c:29ff:fe02:a1b2
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host3_fqdn }}" present with old IP addresses
     ipahost:
@@ -286,7 +287,7 @@
         - "{{ ipv4_prefix + '.221' }}"
         - fe80::20c:29ff:fe02:a1b4
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host3_fqdn }}" present with old IP addresses again
     ipahost:
@@ -299,7 +300,7 @@
         - "{{ ipv4_prefix + '.221' }}"
         - fe80::20c:29ff:fe02:a1b4
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Absent host01.ihavenodns.info test
     ipahost:
@@ -308,7 +309,7 @@
       - name: host01.ihavenodns.info
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host absent
     ipahost:
diff --git a/tests/host/test_host_managedby_host.yml b/tests/host/test_host_managedby_host.yml
index 81fccbd6571097d63994c8748e0ace3089f754ff..a96b674f68d65a49bc018dac59154662819e15f6 100644
--- a/tests/host/test_host_managedby_host.yml
+++ b/tests/host/test_host_managedby_host.yml
@@ -29,7 +29,7 @@
       name: "{{ host1_fqdn }}"
       force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host2_fqdn }}" present
     ipahost:
@@ -37,7 +37,7 @@
       name: "{{ host2_fqdn }}"
       force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" managed by "{{ 'host2.' + ipaserver_domain }}"
     ipahost:
@@ -45,7 +45,7 @@
       name: "{{ host1_fqdn }}"
       managedby_host: "{{ host2_fqdn }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" managed by "{{ 'host2.' + ipaserver_domain }}" again
     ipahost:
@@ -53,7 +53,7 @@
       name: "{{ host1_fqdn }}"
       managedby_host: "{{ host2_fqdn }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" managed by "{{ ansible_facts['fqdn'] }}"
     ipahost:
@@ -62,7 +62,7 @@
       managedby_host: "{{ ansible_facts['fqdn'] }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" managed by "{{ ansible_facts['fqdn'] }}" again
     ipahost:
@@ -71,7 +71,7 @@
       managedby_host: "{{ ansible_facts['fqdn'] }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" not managed by "{{ ansible_facts['fqdn'] }}"
     ipahost:
@@ -81,7 +81,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" not managed by "{{ ansible_facts['fqdn'] }}" again
     ipahost:
@@ -91,7 +91,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" not managed by "{{ 'host2.' + ipaserver_domain }}"
     ipahost:
@@ -101,7 +101,7 @@
       state: absent
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" not managed by "{{ 'host2.' + ipaserver_domain }}" again
     ipahost:
@@ -111,7 +111,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host absent
     ipahost:
@@ -122,4 +122,4 @@
       update_dns: yes
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
diff --git a/tests/host/test_host_principal.yml b/tests/host/test_host_principal.yml
index 0e85626f9099c84639d75730e9f0a9438fb0fc14..6c3e7c909a20cd61bab4ccc352550b6b2eb8a276 100644
--- a/tests/host/test_host_principal.yml
+++ b/tests/host/test_host_principal.yml
@@ -34,7 +34,7 @@
       - "{{ 'host/testhost1.' + ipaserver_domain + '@' + ipaserver_realm }}" 
       force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... principal host/host1... present (existing already)
     ipahost:
@@ -44,7 +44,7 @@
       - "{{ 'host/host1.' + ipaserver_domain + '@' + ipaserver_realm }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host host1... principal host/testhost1... present again
     ipahost:
@@ -53,7 +53,7 @@
       principal: "{{ 'host/testhost1.' + ipaserver_domain + '@' + ipaserver_realm }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host host1... principal host/testhost1... absent
     ipahost:
@@ -63,7 +63,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... principal host/testhost1... absent again
     ipahost:
@@ -73,7 +73,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host host1... principal host/testhost1... and host/myhost1... present
     ipahost:
@@ -84,7 +84,7 @@
       - "{{ 'host/myhost1.' + ipaserver_domain + '@' + ipaserver_realm }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... principal host/testhost1... and host/myhost1... present again
     ipahost:
@@ -95,7 +95,7 @@
       - "{{ 'host/myhost1.' + ipaserver_domain + '@' + ipaserver_realm }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host host1... principal host/testhost1... and host/myhost1... absent
     ipahost:
@@ -107,7 +107,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host host1... principal host/testhost1... and host/myhost1... absent again
     ipahost:
@@ -119,7 +119,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host host1... absent
     ipahost:
diff --git a/tests/host/test_host_random.yml b/tests/host/test_host_random.yml
index 3de73d9611bdb1fe95db53a744a91149da41b2ef..b5b7a13ae71bd2c838e2f8e19567fcc4986b119d 100644
--- a/tests/host/test_host_random.yml
+++ b/tests/host/test_host_random.yml
@@ -31,7 +31,7 @@
       force: yes
       update_password: on_create
     register: ipahost
-    failed_when: not ipahost.changed
+    failed_when: not ipahost.changed or ipahost.failed
 
   - assert:
       that:
@@ -60,7 +60,7 @@
         force: yes
       update_password: on_create
     register: ipahost
-    failed_when: not ipahost.changed
+    failed_when: not ipahost.changed or ipahost.failed
 
   - assert:
       that:
@@ -85,7 +85,7 @@
         random: yes
       update_password: always
     register: ipahost
-    failed_when: ipahost.changed
+    failed_when: ipahost.changed or not ipahost.failed
 
   - assert:
       that:
diff --git a/tests/host/test_host_reverse.yml b/tests/host/test_host_reverse.yml
index 36a0abcc661489cde4fc24ea8862b620bac54b78..8e5e337e168f61acead6011167c8070fae48fa0c 100644
--- a/tests/host/test_host_reverse.yml
+++ b/tests/host/test_host_reverse.yml
@@ -57,7 +57,7 @@
       update_dns: yes
       reverse: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present, again.
     ipahost:
@@ -67,7 +67,7 @@
       update_dns: yes
       reverse: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Hosts host1 absent
     ipahost:
@@ -77,7 +77,7 @@
       update_dns: yes
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present with IPv6
     ipahost:
@@ -87,7 +87,7 @@
       update_dns: yes
       reverse: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ host1_fqdn }}" present with IPv6, again.
     ipahost:
@@ -97,7 +97,7 @@
       update_dns: yes
       reverse: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Hosts host1 absent
     ipahost:
@@ -107,7 +107,7 @@
       update_dns: yes
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Delete zone for reverse address.
     ipadnszone:
diff --git a/tests/host/test_hosts.yml b/tests/host/test_hosts.yml
index cf0f22b927ee53028f54eb272830f3c1e83955ee..53e3b092ee2ba817be77458a1464f7e3808c59f1 100644
--- a/tests/host/test_hosts.yml
+++ b/tests/host/test_hosts.yml
@@ -47,7 +47,7 @@
       - name: "{{ host6_fqdn }}"
         force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Hosts host1..host6 present again
     ipahost:
@@ -66,7 +66,7 @@
       - name: "{{ host6_fqdn }}"
         force: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Hosts host1..host6 absent
     ipahost:
@@ -80,7 +80,7 @@
       - name: "{{ host6_fqdn }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Hosts host1..host6 absent again
     ipahost:
@@ -94,8 +94,10 @@
       - name: "{{ host6_fqdn }}"
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
+  # Use failed_when: not result.failed as this test needs to fail because a
+  # host is added two times in the same task
   - name: Duplicate names in hosts failure test
     ipahost:
       ipaadmin_password: SomeADMINpassword
@@ -109,4 +111,4 @@
       - name: "{{ host3_fqdn }}"
         force: yes
     register: result
-    failed_when: result.changed or "is used more than once" not in result.msg
+    failed_when: result.changed or not result.failed or "is used more than once" not in result.msg
diff --git a/tests/host/test_hosts_managedby_host.yml b/tests/host/test_hosts_managedby_host.yml
index 95f71dcde1f1cd278974f47afb8f62979ade5c13..51d7272cd5cd7b299812a71f305dae0b3d183271 100644
--- a/tests/host/test_hosts_managedby_host.yml
+++ b/tests/host/test_hosts_managedby_host.yml
@@ -35,7 +35,7 @@
       name: "{{ host5_fqdn }}"
       force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Hosts "{{ host1_fqdn }}" .. "{{ 'host5.' + ipaserver_domain }}" present and managed by "{{ 'host5.' + ipaserver_domain }}"
     ipahost:
@@ -57,7 +57,7 @@
         managedby_host: "{{ host5_fqdn }}"
         force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Hosts "{{ host1_fqdn }}" .. "{{ 'host5.' + ipaserver_domain }}" present and managed by "{{ 'host5.' + ipaserver_domain }}" again
     ipahost:
@@ -79,7 +79,7 @@
         managedby_host: "{{ host5_fqdn }}"
         force: yes
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Hosts "{{ host1_fqdn }}" .. "{{ 'host5.' + ipaserver_domain }}" managed by "{{ 'host5.' + ipaserver_domain }}"
     ipahost:
@@ -97,7 +97,7 @@
         managedby_host: "{{ host5_fqdn }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Hosts "{{ host1_fqdn }}" .. "{{ 'host5.' + ipaserver_domain }}" not managed by "{{ 'host5.' + ipaserver_domain }}"
     ipahost:
@@ -116,7 +116,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Hosts "{{ host1_fqdn }}" .. "{{ 'host5.' + ipaserver_domain }}" not managed by "{{ 'host5.' + ipaserver_domain }}" again
     ipahost:
@@ -135,7 +135,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Hosts "{{ host1_fqdn }}" .. "{{ 'host5.' + ipaserver_domain }}" absent
     ipahost:
@@ -148,4 +148,4 @@
       - name: "{{ host5_fqdn }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
diff --git a/tests/host/test_hosts_principal.yml b/tests/host/test_hosts_principal.yml
index 67b4a202f8900f009a3646c4919f182d68da0499..4276da61a70a612bfcf124dbc355eddcc1c444ec 100644
--- a/tests/host/test_hosts_principal.yml
+++ b/tests/host/test_hosts_principal.yml
@@ -41,7 +41,7 @@
         - "{{ 'host/testhost2.' + ipaserver_domain + '@' + ipaserver_realm }}" 
         force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host hostX... principal 'host/hostX... present (existing already) X=[1,2]
     ipahost:
@@ -55,7 +55,7 @@
         - "{{ 'host/host2.' + ipaserver_domain + '@' + ipaserver_realm }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host hostX... principal host/testhostX... present again X=[1,2]
     ipahost:
@@ -69,7 +69,7 @@
         - "{{ 'host/testhost2.' + ipaserver_domain + '@' + ipaserver_realm }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host hostX.. principal host/testhostX... absent X=[1,2]
     ipahost:
@@ -84,7 +84,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host hostX... principal host/testhostX... absent again X=[1,2]
     ipahost:
@@ -99,7 +99,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host hostX... principal host/testhostX... and host/myhostX... present X=[1,2]
     ipahost:
@@ -115,7 +115,7 @@
         - "{{ 'host/myhost2.' + ipaserver_domain + '@' + ipaserver_realm }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host hostX... principal host/testhostX... and host/myhostX... present again X=[1,2]
     ipahost:
@@ -131,7 +131,7 @@
         - "{{ 'host/myhost2.' + ipaserver_domain + '@' + ipaserver_realm }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Host hostX... principal host/testhostX... and host/myhostX... absent X=[1,2]
     ipahost:
@@ -148,7 +148,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host hostX... principal host/testhostX... and host/myhostX... absent again X=[1,2]
     ipahost:
@@ -165,7 +165,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Hosts host1... and host2... absent
     ipahost:
diff --git a/tests/hostgroup/test_hostgroup.yml b/tests/hostgroup/test_hostgroup.yml
index a0df6ec1cf8dda4447f2fb339995f91df8fff572..1b1ba7a626b7c28b36cd94b3959e1798ee19ae3f 100644
--- a/tests/hostgroup/test_hostgroup.yml
+++ b/tests/hostgroup/test_hostgroup.yml
@@ -33,7 +33,7 @@
       name: "{{ 'db1.' + ipaserver_domain }}"
       force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Host "{{ 'db2.' + ipaserver_domain }}" present
     ipahost:
@@ -41,7 +41,7 @@
       name: "{{ 'db2.' + ipaserver_domain }}"
       force: yes
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group mysql-server is present
     ipahostgroup:
@@ -49,7 +49,7 @@
       name: mysql-server
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group mysql-server is present again
     ipahostgroup:
@@ -57,7 +57,7 @@
       name: mysql-server
       state: present
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure host-group oracle-server is present
     ipahostgroup:
@@ -65,7 +65,7 @@
       name: oracle-server
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group oracle-server is present again
     ipahostgroup:
@@ -73,7 +73,7 @@
       name: oracle-server
       state: present
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure host-group databases is present
     ipahostgroup:
@@ -85,7 +85,7 @@
       hostgroup:
       - oracle-server
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group databases is present again
     ipahostgroup:
@@ -97,7 +97,7 @@
       hostgroup:
       - oracle-server
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure host db2 is member of host-group databases
     ipahostgroup:
@@ -108,7 +108,7 @@
       - "{{ 'db2.' + ipaserver_domain }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host db2 is member of host-group databases again
     ipahostgroup:
@@ -119,7 +119,7 @@
       - "{{ 'db2.' + ipaserver_domain }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure host-group mysql-server is member of host-group databases
     ipahostgroup:
@@ -130,7 +130,7 @@
       - mysql-server
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group mysql-server is member of host-group databases again
     ipahostgroup:
@@ -141,7 +141,7 @@
       - mysql-server
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure host-group oracle-server is member of host-group databases (again)
     ipahostgroup:
@@ -152,7 +152,7 @@
       - oracle-server
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure host-group databases, mysql-server and oracle-server are absent
     ipahostgroup:
@@ -163,7 +163,7 @@
       - oracle-server
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host-group databases, mysql-server and oracle-server are absent again
     ipahostgroup:
@@ -174,7 +174,7 @@
       - oracle-server
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Test hosts db1 and db2 absent
     ipahost:
diff --git a/tests/hostgroup/test_hostgroup_membermanager.yml b/tests/hostgroup/test_hostgroup_membermanager.yml
index 2af8445de9e54719a5ed3fe5bea146a97c68d16c..ff8adc87844dd106e0c448163f50d4d4b3198552 100644
--- a/tests/hostgroup/test_hostgroup_membermanager.yml
+++ b/tests/hostgroup/test_hostgroup_membermanager.yml
@@ -45,21 +45,21 @@
             first: manageruser2
             last: Last2
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure managergroup1 is present
         ipagroup:
           ipaadmin_password: SomeADMINpassword
           name: managergroup1
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure managergroup2 is present
         ipagroup:
           ipaadmin_password: SomeADMINpassword
           name: managergroup2
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager user1 is present for testhostgroup
         ipahostgroup:
@@ -67,7 +67,7 @@
           name: testhostgroup
           membermanager_user: manageruser1
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager user1 is present for testhostgroup again
         ipahostgroup:
@@ -75,7 +75,7 @@
           name: testhostgroup
           membermanager_user: manageruser1
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure membermanager group1 is present for testhostgroup
         ipahostgroup:
@@ -83,7 +83,7 @@
           name: testhostgroup
           membermanager_group: managergroup1
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager group1 is present for testhostgroup again
         ipahostgroup:
@@ -91,7 +91,7 @@
           name: testhostgroup
           membermanager_group: managergroup1
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure membermanager user2 and group2 members are present for testhostgroup
         ipahostgroup:
@@ -101,7 +101,7 @@
           membermanager_group: managergroup2
           action: member
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager user2 and group2 members are present for testhostgroup again
         ipahostgroup:
@@ -111,7 +111,7 @@
           membermanager_group: managergroup2
           action: member
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure membermanager user and group members are present for testhostgroup again
         ipahostgroup:
@@ -121,7 +121,7 @@
           membermanager_group: managergroup1,managergroup2
           action: member
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure membermanager user1 and group1 members are absent for testhostgroup
         ipahostgroup:
@@ -132,7 +132,7 @@
           action: member
           state: absent
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager user1 and group1 members are absent for testhostgroup again
         ipahostgroup:
@@ -143,7 +143,7 @@
           action: member
           state: absent
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
 
       - name: Ensure membermanager user1 and group1 members are present for testhostgroup
@@ -154,7 +154,7 @@
           membermanager_group: managergroup1
           action: member
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager user1 and group1 members are present for testhostgroup again
         ipahostgroup:
@@ -164,7 +164,7 @@
           membermanager_group: managergroup1
           action: member
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure membermanager user and group members are absent for testhostgroup
         ipahostgroup:
@@ -175,7 +175,7 @@
           action: member
           state: absent
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure membermanager user and group members are absent for testhostgroup again
         ipahostgroup:
@@ -186,7 +186,7 @@
           action: member
           state: absent
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure user manangeruser1 and manageruser2 is absent
         ipauser:
@@ -194,7 +194,7 @@
           name: manageruser1,manageruser2
           state: absent
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure group managergroup1 and managergroup2 are absent
         ipagroup:
@@ -202,8 +202,10 @@
           name: managergroup1,managergroup2
           state: absent
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
+      # Do not add failed_when result.failed, as this test needs to fail
+      # due to using an unknown user
       - name: Ensure unknown membermanager_user member failure
         ipahostgroup:
           ipaadmin_password: SomeADMINpassword
@@ -220,5 +222,5 @@
           - testhostgroup
           state: absent
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
     when: ipa_version is version('4.8.4', '>=')
diff --git a/tests/hostgroup/test_hostgroup_rename.yml b/tests/hostgroup/test_hostgroup_rename.yml
index 98007175a6a64e0542bf43d4003feb8bd149b1b0..d3dd33b25b962c96fb2c8f2f7076f7e76c950bf4 100644
--- a/tests/hostgroup/test_hostgroup_rename.yml
+++ b/tests/hostgroup/test_hostgroup_rename.yml
@@ -24,7 +24,7 @@
           name: databases
           state: present
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Rename host-group from `databases` to `datalake`
         ipahostgroup:
@@ -33,7 +33,7 @@
           rename: datalake
           state: renamed
         register: result
-        failed_when: not result.changed
+        failed_when: not result.changed or result.failed
 
       - name: Ensure host-group database was already absent
         ipahostgroup:
@@ -41,7 +41,7 @@
           name: database
           state: absent
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Rename host-group from `databases` to `datalake`, again
         ipahostgroup:
@@ -59,7 +59,7 @@
           rename: datalake
           state: renamed
         register: result
-        failed_when: result.changed
+        failed_when: result.changed or result.failed
 
       - name: Ensure testing hostgroups do not exist.
         ipahostgroup:
diff --git a/tests/pwpolicy/test_pwpolicy.yml b/tests/pwpolicy/test_pwpolicy.yml
index d5a254e478ed240a1cae376649ca0e0f13d35ae4..ef28ef00430cb6a0ea466349473911cd1c9013a9 100644
--- a/tests/pwpolicy/test_pwpolicy.yml
+++ b/tests/pwpolicy/test_pwpolicy.yml
@@ -28,7 +28,7 @@
       name: ops
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure presence of pwpolicies for group ops
     ipapwpolicy:
@@ -44,7 +44,7 @@
       maxfail: 3
       failinterval: 5
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure presence of pwpolicies for group ops again
     ipapwpolicy:
@@ -60,21 +60,21 @@
       maxfail: 3
       failinterval: 5
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure maxlife of 49 for global_policy
     ipapwpolicy:
       ipaadmin_password: SomeADMINpassword
       maxlife: 49
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure maxlife of 49 for global_policy again
     ipapwpolicy:
       ipaadmin_password: SomeADMINpassword
       maxlife: 49
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure absence of pwpoliciy global_policy will fail
     ipapwpolicy:
@@ -82,7 +82,7 @@
       state: absent
     register: result
     ignore_errors: True
-    failed_when: result is defined and result
+    failed_when: (result is defined and result) or result.failed
 
   - name: Ensure absence of pwpolicies for group ops
     ipapwpolicy:
@@ -90,14 +90,14 @@
       name: ops
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure maxlife of 90 for global_policy
     ipapwpolicy:
       ipaadmin_password: SomeADMINpassword
       maxlife: 90
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure absence of pwpolicies for group ops
     ipapwpolicy:
@@ -105,4 +105,4 @@
       name: ops
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
diff --git a/tests/role/test_role.yml b/tests/role/test_role.yml
index f72a9321946c714341152a7f1f9c9102052000b1..0c4661e669eb20fdc3bf7fc390f1c4e8822d43c4 100644
--- a/tests/role/test_role.yml
+++ b/tests/role/test_role.yml
@@ -18,7 +18,7 @@
       name: renamerole
       description: A role in IPA.
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role is present, again.
     iparole:
@@ -26,7 +26,7 @@
       name: renamerole
       description: A role in IPA.
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Rename role.
     iparole:
@@ -34,8 +34,10 @@
       name: renamerole
       rename: testrole
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
+  # Do not test result.failed, this task will fail as there is no role to
+  # be renamed.
   - name: Rename role, again.
     iparole:
       ipaadmin_password: SomeADMINpassword
@@ -53,7 +55,7 @@
       - Host Administrators
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role has member has privileges, again.
     iparole:
@@ -64,7 +66,7 @@
       - Host Administrators
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role has less privileges.
     iparole:
@@ -75,7 +77,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role has less privileges, again.
     iparole:
@@ -86,7 +88,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role has member has privileges restored.
     iparole:
@@ -97,7 +99,7 @@
       - Host Administrators
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role has member has privileges restored, again.
     iparole:
@@ -108,7 +110,7 @@
       - Host Administrators
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role member privileges are absent.
     iparole:
@@ -120,7 +122,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role member privileges are absent, again.
     iparole:
@@ -132,7 +134,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure invalid privileged is not assigned to role.
     iparole:
@@ -151,7 +153,7 @@
       - user01
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role has member user present, again.
     iparole:
@@ -161,7 +163,7 @@
       - user01
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role has member user absent.
     iparole:
@@ -172,7 +174,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role has member user absent, again.
     iparole:
@@ -183,7 +185,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role has member group present.
     iparole:
@@ -193,7 +195,7 @@
       - group01
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role has member group present, again.
     iparole:
@@ -203,7 +205,7 @@
       - group01
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role has member group absent.
     iparole:
@@ -214,7 +216,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role has member group absent, again.
     iparole:
@@ -225,7 +227,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role has member host present.
     iparole:
@@ -235,7 +237,7 @@
       - "{{ host1_fqdn }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role has member host present, again.
     iparole:
@@ -245,7 +247,7 @@
       - "{{ host1_fqdn }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role has member host absent.
     iparole:
@@ -256,7 +258,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role has member host absent, again.
     iparole:
@@ -267,7 +269,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role has member hostgroup present.
     iparole:
@@ -277,7 +279,7 @@
       - hostgroup01
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role has member hostgroup present, again.
     iparole:
@@ -287,7 +289,7 @@
       - hostgroup01
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role has member hostgroup absent.
     iparole:
@@ -298,7 +300,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role has member hostgroup absent, again.
     iparole:
@@ -309,7 +311,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role is absent.
     iparole:
@@ -317,7 +319,7 @@
       name: testrole
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role is absent, again.
     iparole:
@@ -325,7 +327,7 @@
       name: testrole
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role with members is present.
     iparole:
@@ -345,7 +347,7 @@
       service:
       - "service01/{{ host1_fqdn }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role with members is present, again.
     iparole:
@@ -365,7 +367,7 @@
       service:
       - "service01/{{ host1_fqdn }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role is absent.
     iparole:
@@ -373,7 +375,7 @@
       name: testrole
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role is absent, again.
     iparole:
@@ -381,7 +383,7 @@
       name: testrole
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # cleanup
   - name: Cleanup environment.
diff --git a/tests/role/test_role_service_member.yml b/tests/role/test_role_service_member.yml
index 065cbce7307fb24881d79a66c3932cb021b2407f..307dc94f3cedc9d1124fd99983a112909e3ff55f 100644
--- a/tests/role/test_role_service_member.yml
+++ b/tests/role/test_role_service_member.yml
@@ -20,7 +20,7 @@
       service:
       - "service01/{{ host1_fqdn }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role with member service is present, again.
     iparole:
@@ -30,7 +30,7 @@
       - "service01/{{ host1_fqdn }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role has member service absent.
     iparole:
@@ -41,7 +41,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role has member service absent, again.
     iparole:
@@ -52,7 +52,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role has member service with principal name.
     iparole:
@@ -62,7 +62,7 @@
       - "service01/{{ host1_fqdn }}@{{ ipaserver_realm }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role has member service with principal name, again.
     iparole:
@@ -72,7 +72,7 @@
       - "service01/{{ host1_fqdn }}@{{ ipaserver_realm }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure role is absent.
     iparole:
@@ -80,7 +80,7 @@
       name: testrole
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure role is absent, again.
     iparole:
@@ -88,7 +88,7 @@
       name: testrole
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # cleanup
   - name: Cleanup environment.
diff --git a/tests/sudocmd/test_sudocmd.yml b/tests/sudocmd/test_sudocmd.yml
index c66e8108e1939e2822d9de4f0c6f2c894568aae9..992dba7d936728cb080d408bb1459f95e92cf44d 100644
--- a/tests/sudocmd/test_sudocmd.yml
+++ b/tests/sudocmd/test_sudocmd.yml
@@ -21,7 +21,7 @@
       name: /usr/bin/su
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudocmd is present again
     ipasudocmd:
@@ -29,7 +29,7 @@
       name: /usr/bin/su
       state: present
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudocmd is absent
     ipasudocmd:
@@ -37,7 +37,7 @@
       name: /usr/bin/su
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudocmd is absent again
     ipasudocmd:
@@ -45,7 +45,7 @@
       name: /usr/bin/su
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure multiple sudocmd are present
     ipasudocmd:
@@ -55,7 +55,7 @@
       - /usr/sbin/iwlist
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure multiple sudocmd are present again
     ipasudocmd:
@@ -65,7 +65,7 @@
       - /usr/sbin/iwlist
       state: present
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure multiple sudocmd are absent
     ipasudocmd:
@@ -75,7 +75,7 @@
       - /usr/sbin/iwlist
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure multiple sudocmd are absent again
     ipasudocmd:
@@ -85,7 +85,8 @@
       - /usr/sbin/iwlist
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
+
   - name: Ensure sudocmds are absent
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
@@ -117,4 +118,4 @@
       - /usr/sbin/iwlist
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
diff --git a/tests/sudocmdgroup/test_sudocmdgroup.yml b/tests/sudocmdgroup/test_sudocmdgroup.yml
index 86b01f35610942634e201a9877baa270fff9bcb2..17c6088569ada896648a05c3603d909e9c335223 100644
--- a/tests/sudocmdgroup/test_sudocmdgroup.yml
+++ b/tests/sudocmdgroup/test_sudocmdgroup.yml
@@ -26,7 +26,7 @@
       name: network
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudocmdgroup is present again
     ipasudocmdgroup:
@@ -34,7 +34,7 @@
       name: network
       state: present
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudocmdgroup is absent
     ipasudocmdgroup:
@@ -42,7 +42,7 @@
       name: network
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudocmdgroup is absent again
     ipasudocmdgroup:
@@ -50,7 +50,7 @@
       name: network
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudocmdgroup is present, with sudocmds.
     ipasudocmdgroup:
@@ -61,7 +61,7 @@
       - /usr/sbin/iwlist
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudocmdgroup is present, with sudocmds, again.
     ipasudocmdgroup:
@@ -72,7 +72,7 @@
       - /usr/sbin/iwlist
       state: present
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Verify sudocmdgroup creation with sudocmds
     shell: |
@@ -88,7 +88,7 @@
       name: network
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudocmdgroup, with sudocmds, is absent again
     ipasudocmdgroup:
@@ -96,7 +96,7 @@
       name: network
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure testing sudocmdgroup is present
     ipasudocmdgroup:
@@ -104,7 +104,7 @@
       name: network
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudo commands are present in existing sudocmdgroup
     ipasudocmdgroup:
@@ -115,7 +115,7 @@
       - /usr/sbin/iwlist
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudo commands are present in existing sudocmdgroup, again
     ipasudocmdgroup:
@@ -126,7 +126,7 @@
       - /usr/sbin/iwlist
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudo commands are absent in existing sudocmdgroup
     ipasudocmdgroup:
@@ -138,7 +138,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudo commands are absent in existing sudocmdgroup, again
     ipasudocmdgroup:
@@ -150,7 +150,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudo commands are present in sudocmdgroup
     ipasudocmdgroup:
@@ -162,7 +162,7 @@
       action: member
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure one sudo command is not present in sudocmdgroup
     ipasudocmdgroup:
@@ -173,7 +173,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure one sudo command is present in sudocmdgroup
     ipasudocmdgroup:
@@ -184,7 +184,7 @@
       action: member
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure the other sudo command is not present in sudocmdgroup
     ipasudocmdgroup:
@@ -195,7 +195,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure the other sudo commandsis not present in sudocmdgroup, again
     ipasudocmdgroup:
@@ -206,4 +206,4 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
diff --git a/tests/sudorule/test_sudorule.yml b/tests/sudorule/test_sudorule.yml
index 579db11ba54c6547dbe1f14a12278245fc81fb28..3b01a085bc770e7492ee15185306e502e43abc4b 100644
--- a/tests/sudorule/test_sudorule.yml
+++ b/tests/sudorule/test_sudorule.yml
@@ -77,14 +77,14 @@
       ipaadmin_password: SomeADMINpassword
       name: testrule1
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present again
     ipasudorule:
       ipaadmin_password: SomeADMINpassword
       name: testrule1
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure user01 is on the list of users sudorule execute as.
     ipasudorule:
@@ -94,7 +94,7 @@
         - user01
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure user01 is on the list of users sudorule execute as, again.
     ipasudorule:
@@ -104,7 +104,7 @@
         - user01
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure user01 is not on the list of users sudorule execute as.
     ipasudorule:
@@ -115,7 +115,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure user01 is not on the list of users sudorule execute as, again.
     ipasudorule:
@@ -126,7 +126,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure group01 is on the list of group sudorule execute as.
     ipasudorule:
@@ -136,7 +136,7 @@
         - group01
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group01 is on the list of group sudorule execute as, again.
     ipasudorule:
@@ -146,7 +146,7 @@
         - group01
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure group01 is not on the list of group sudorule execute as.
     ipasudorule:
@@ -157,7 +157,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group01 is not on the list of groups sudorule execute as, again.
     ipasudorule:
@@ -168,7 +168,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, with usercategory 'all'
     ipasudorule:
@@ -176,7 +176,7 @@
       name: allusers
       usercategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with usercategory 'all', again
     ipasudorule:
@@ -184,7 +184,7 @@
       name: allusers
       usercategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is with usercategory 'all' is absent
     ipasudorule:
@@ -192,7 +192,7 @@
       name: allusers
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with runasusercategory 'all'.
     ipasudorule:
@@ -200,7 +200,7 @@
       name: allusers
       runasusercategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with runasusercategory 'all', again.
     ipasudorule:
@@ -208,7 +208,7 @@
       name: allusers
       runasusercategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is with runasusercategory 'all' is absent
     ipasudorule:
@@ -216,7 +216,7 @@
       name: allusers
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with runasgroupcategory 'all'.
     ipasudorule:
@@ -224,7 +224,7 @@
       name: allusers
       runasgroupcategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with runasgroupcategory 'all', again.
     ipasudorule:
@@ -232,7 +232,7 @@
       name: allusers
       runasgroupcategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is with runasgroupcategory 'all' is absent
     ipasudorule:
@@ -240,7 +240,7 @@
       name: allusers
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with usercategory 'all'.
     ipasudorule:
@@ -248,7 +248,7 @@
       name: allusers
       usercategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with usercategory 'all', again.
     ipasudorule:
@@ -256,7 +256,7 @@
       name: allusers
       usercategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, with hostategory 'all'
     ipasudorule:
@@ -264,7 +264,7 @@
       name: allhosts
       hostcategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with hostategory 'all', again
     ipasudorule:
@@ -272,13 +272,15 @@
       name: allhosts
       hostcategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is disabled
     ipasudorule:
       ipaadmin_password: SomeADMINpassword
       name: testrule1
       state: disabled
+    register: result
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is disabled, again
     ipasudorule:
@@ -286,7 +288,7 @@
       name: testrule1
       state: disabled
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is enabled
     ipasudorule:
@@ -294,7 +296,7 @@
       name: testrule1
       state: enabled
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is enabled, again
     ipasudorule:
@@ -302,7 +304,7 @@
       name: testrule1
       state: enabled
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure user is present in sudorule.
     ipasudorule:
@@ -311,7 +313,7 @@
       user: user01
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure user is present in sudorule, again.
     ipasudorule:
@@ -320,7 +322,7 @@
       user: user01
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure user is absent from sudorule.
     ipasudorule:
@@ -330,7 +332,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure user is absent from sudorule, again.
     ipasudorule:
@@ -340,7 +342,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure group is present in sudorule.
     ipasudorule:
@@ -349,7 +351,7 @@
       group: group01
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group is present in sudorule, again.
     ipasudorule:
@@ -358,7 +360,7 @@
       group: group01
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure group is absent from sudorule.
     ipasudorule:
@@ -368,7 +370,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure group is absent from sudorule, again.
     ipasudorule:
@@ -378,7 +380,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule has a sudooption.
     ipasudorule:
@@ -387,7 +389,7 @@
       sudooption: '!authenticate'
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule has a sudooption, again.
     ipasudorule:
@@ -396,7 +398,7 @@
       sudooption: '!authenticate'
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule has an order.
     ipasudorule:
@@ -404,7 +406,7 @@
       name: testrule1
       order: 1
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule has an order, again.
     ipasudorule:
@@ -412,7 +414,7 @@
       name: testrule1
       order: 1
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule has another order.
     ipasudorule:
@@ -420,7 +422,7 @@
       name: testrule1
       order: 10
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present and some sudocmd are allowed.
     ipasudorule:
@@ -430,7 +432,7 @@
       - /sbin/ifconfig
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present and some sudocmd are allowed, again.
     ipasudorule:
@@ -440,7 +442,7 @@
       - /sbin/ifconfig
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present and some sudocmd are denyed.
     ipasudorule:
@@ -450,7 +452,7 @@
       - /usr/bin/vim
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present and some sudocmd are denyed, again.
     ipasudorule:
@@ -460,7 +462,7 @@
       - /usr/bin/vim
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present and, sudocmds are absent.
     ipasudorule:
@@ -471,7 +473,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present and, sudocmds are absent, again.
     ipasudorule:
@@ -482,7 +484,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present with cmdcategory 'all'.
     ipasudorule:
@@ -490,7 +492,7 @@
       name: allcommands
       cmdcategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present with cmdcategory 'all', again.
     ipasudorule:
@@ -498,7 +500,7 @@
       name: allcommands
       cmdcategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure host "{{ ansible_facts['fqdn'] }}" is present in sudorule.
     ipasudorule:
@@ -507,7 +509,7 @@
       host: "{{ ansible_facts['fqdn'] }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure host "{{ ansible_facts['fqdn'] }}" is present in sudorule, again.
     ipasudorule:
@@ -516,7 +518,7 @@
       host: "{{ ansible_facts['fqdn'] }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure hostgroup is present in sudorule.
     ipasudorule:
@@ -525,7 +527,7 @@
       hostgroup: cluster
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure hostgroup is present in sudorule, again.
     ipasudorule:
@@ -534,7 +536,7 @@
       hostgroup: cluster
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, with an allow_sudocmdgroup.
     ipasudorule:
@@ -543,7 +545,7 @@
       allow_sudocmdgroup: test_sudorule
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with an allow_sudocmdgroup, again.
     ipasudorule:
@@ -552,7 +554,7 @@
       allow_sudocmdgroup: test_sudorule
       state: present
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, but allow_sudocmdgroup is absent.
     ipasudorule:
@@ -562,7 +564,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, but allow_sudocmdgroup is absent.
     ipasudorule:
@@ -572,7 +574,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, with an deny_sudocmdgroup.
     ipasudorule:
@@ -581,7 +583,7 @@
       deny_sudocmdgroup: test_sudorule
       state: present
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with an deny_sudocmdgroup, again.
     ipasudorule:
@@ -590,7 +592,7 @@
       deny_sudocmdgroup: test_sudorule
       state: present
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, but deny_sudocmdgroup is absent.
     ipasudorule:
@@ -600,7 +602,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, but deny_sudocmdgroup is absent, again.
     ipasudorule:
@@ -610,7 +612,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is absent
     ipasudorule:
@@ -618,7 +620,7 @@
       name: testrule1
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is absent, again.
     ipasudorule:
@@ -626,7 +628,7 @@
       name: testrule1
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule allhosts is absent
     ipasudorule:
@@ -634,7 +636,7 @@
       name: allhosts
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule allhosts is absent, again
     ipasudorule:
@@ -642,7 +644,7 @@
       name: allhosts
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule allusers is absent
     ipasudorule:
@@ -650,7 +652,7 @@
       name: allusers
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule allusers is absent, again
     ipasudorule:
@@ -658,7 +660,7 @@
       name: allusers
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule allcommands is absent
     ipasudorule:
@@ -666,7 +668,7 @@
       name: allcommands
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule allcommands is absent, again
     ipasudorule:
@@ -674,7 +676,7 @@
       name: allcommands
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   # cleanup
   - name : Ensure sudocmdgroup is absent
diff --git a/tests/sudorule/test_sudorule_categories.yml b/tests/sudorule/test_sudorule_categories.yml
index 43d735202de833ed03680b14a5ad01976f545025..3b8c1926e1f75ab27e83eb10a34591f3f6d6af8c 100644
--- a/tests/sudorule/test_sudorule_categories.yml
+++ b/tests/sudorule/test_sudorule_categories.yml
@@ -22,7 +22,7 @@
       name: allusers
       usercategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with usercategory 'all', again.
     ipasudorule:
@@ -30,7 +30,7 @@
       name: allusers
       usercategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, with no usercategory.
     ipasudorule:
@@ -38,7 +38,7 @@
       name: allusers
       usercategory: ""
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with no usercategory, again.
     ipasudorule:
@@ -46,7 +46,7 @@
       name: allusers
       usercategory: ""
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, with hostcategory 'all'
     ipasudorule:
@@ -54,7 +54,7 @@
       name: allusers
       hostcategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with hostcategory 'all', again.
     ipasudorule:
@@ -62,7 +62,7 @@
       name: allusers
       hostcategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, with no usercategory.
     ipasudorule:
@@ -70,7 +70,7 @@
       name: allusers
       hostcategory: ""
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with no hostcategory, again.
     ipasudorule:
@@ -78,7 +78,7 @@
       name: allusers
       hostcategory: ""
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, with cmdcategory 'all'
     ipasudorule:
@@ -86,7 +86,7 @@
       name: allusers
       cmdcategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with cmdcategory 'all', again.
     ipasudorule:
@@ -94,7 +94,7 @@
       name: allusers
       cmdcategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, with no cmdcategory.
     ipasudorule:
@@ -102,7 +102,7 @@
       name: allusers
       cmdcategory: ""
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with no cmdcategory, again.
     ipasudorule:
@@ -110,7 +110,7 @@
       name: allusers
       cmdcategory: ""
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, with runasusercategory 'all'
     ipasudorule:
@@ -118,7 +118,7 @@
       name: allusers
       runasusercategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with runasusercategory 'all', again.
     ipasudorule:
@@ -126,7 +126,7 @@
       name: allusers
       runasusercategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, with no runasusercategory.
     ipasudorule:
@@ -134,7 +134,7 @@
       name: allusers
       runasusercategory: ""
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with no runasusercategory, again.
     ipasudorule:
@@ -142,7 +142,7 @@
       name: allusers
       runasusercategory: ""
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, with runasgroupcategory 'all'
     ipasudorule:
@@ -150,7 +150,7 @@
       name: allusers
       runasgroupcategory: all
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with runasgroupcategory 'all', again.
     ipasudorule:
@@ -158,7 +158,7 @@
       name: allusers
       runasgroupcategory: all
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorule is present, with no runasgroupcategory.
     ipasudorule:
@@ -166,7 +166,7 @@
       name: allusers
       runasgroupcategory: ""
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure sudorule is present, with no runasgroupcategory, again.
     ipasudorule:
@@ -174,7 +174,7 @@
       name: allusers
       runasgroupcategory: ""
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure sudorules are absent
     ipasudorule:
@@ -183,7 +183,7 @@
       - allusers
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure `host` cannot be added if hostcategory is `all`.
     ipasudorule:
diff --git a/tests/user/certificate/test_user_certificate.yml b/tests/user/certificate/test_user_certificate.yml
index d1e157fdf5d51eef482e79300bb026b699204dc4..5ea6fe90f371f8980a3a4c71dfb2cf55db9b4c17 100644
--- a/tests/user/certificate/test_user_certificate.yml
+++ b/tests/user/certificate/test_user_certificate.yml
@@ -32,21 +32,19 @@
       - "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test cert members present again
     ipauser:
       ipaadmin_password: SomeADMINpassword
       name: test
-      first: test
-      last: test
       certificate:
       - "{{ lookup('file', 'cert1.b64', rstrip=False) }}"
       - "{{ lookup('file', 'cert2.b64', rstrip=False) }}"
       - "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test cert members absent
     ipauser:
@@ -59,7 +57,7 @@
       state: absent
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test cert members absent again
     ipauser:
@@ -72,7 +70,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test absent
     ipauser:
@@ -80,7 +78,7 @@
       name: test
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Remove certificate files.
     shell:
diff --git a/tests/user/certificate/test_users_certificate.yml b/tests/user/certificate/test_users_certificate.yml
index 78198016d548b296f4872f4feeabb83ad9f8e6c5..406e6030e55c559db62d4206c3d97ab05e492a8e 100644
--- a/tests/user/certificate/test_users_certificate.yml
+++ b/tests/user/certificate/test_users_certificate.yml
@@ -41,7 +41,7 @@
         - "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test cert members present again
     ipauser:
@@ -54,7 +54,7 @@
         - "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test cert members absent
     ipauser:
@@ -68,7 +68,7 @@
       state: absent
       action: member
     #register: result
-    #failed_when: not result.changed
+    #failed_when: not result.changed or result.failed
 
   - name: User test cert members absent again
     ipauser:
@@ -82,7 +82,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test absent
     ipauser:
@@ -91,7 +91,7 @@
       - name: test
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Remove certificate files.
     shell:
diff --git a/tests/user/certmapdata/test_user_certmapdata.yml b/tests/user/certmapdata/test_user_certmapdata.yml
index 79df66c316dcbbc326611ba5afb40dc12a7e3541..144d49f4266d3135898c72c7349a2873d124aefc 100644
--- a/tests/user/certmapdata/test_user_certmapdata.yml
+++ b/tests/user/certmapdata/test_user_certmapdata.yml
@@ -28,7 +28,7 @@
       first: test
       last: test
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members present
     ipauser:
@@ -40,7 +40,7 @@
         - certificate: "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members present again
     ipauser:
@@ -52,7 +52,7 @@
         - certificate: "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test certmapdata members absent
     ipauser:
@@ -65,7 +65,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members absent again
     ipauser:
@@ -78,7 +78,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test certmapdata members present
     ipauser:
@@ -93,7 +93,7 @@
         subject: CN=subject3
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members present again
     ipauser:
@@ -108,7 +108,7 @@
         subject: CN=subject3
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test certmapdata members absent
     ipauser:
@@ -122,7 +122,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members absent again
     ipauser:
@@ -136,7 +136,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test certmapdata members absent
     ipauser:
@@ -148,7 +148,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members absent again
     ipauser:
@@ -160,7 +160,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test certmapdata member present
     ipauser:
@@ -171,7 +171,7 @@
         subject: CN=test,dc=example,dc=com
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata member present again
     ipauser:
@@ -182,7 +182,7 @@
         subject: CN=test,dc=example,dc=com
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test certmapdata member (data) present again
     ipauser:
@@ -192,7 +192,7 @@
       - data: X509:<I>dc=com,dc=example,CN=ca<S>dc=com,dc=example,CN=test
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test certmapdata member absent
     ipauser:
@@ -204,7 +204,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata member (data) absent again
     ipauser:
@@ -215,7 +215,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test absent
     ipauser:
@@ -223,7 +223,7 @@
       name: test
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Remove certificate files.
     shell:
diff --git a/tests/user/certmapdata/test_user_certmapdata_issuer_subject.yml b/tests/user/certmapdata/test_user_certmapdata_issuer_subject.yml
index 0309c6af2612ee2e06b566114be0eddcbd1f82da..2d323b49f9f586e64dc988757fa00fc2138d39db 100644
--- a/tests/user/certmapdata/test_user_certmapdata_issuer_subject.yml
+++ b/tests/user/certmapdata/test_user_certmapdata_issuer_subject.yml
@@ -18,7 +18,7 @@
       first: test
       last: test
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members present
     ipauser:
@@ -33,7 +33,7 @@
         subject: CN=subject3
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members present again
     ipauser:
@@ -48,7 +48,7 @@
         subject: CN=subject3
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test certmapdata members absent
     ipauser:
@@ -64,7 +64,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members absent again
     ipauser:
@@ -80,7 +80,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test absent
     ipauser:
@@ -88,4 +88,4 @@
       name: test
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
diff --git a/tests/user/certmapdata/test_users_certmapdata.yml b/tests/user/certmapdata/test_users_certmapdata.yml
index fdde23f40aa518472a9a776a78a21f6fb2602eee..b871fb9cb792e858ff7ff17dfbc5c1574edeab20 100644
--- a/tests/user/certmapdata/test_users_certmapdata.yml
+++ b/tests/user/certmapdata/test_users_certmapdata.yml
@@ -30,7 +30,7 @@
         first: test
         last: test
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members present
     ipauser:
@@ -43,7 +43,7 @@
         - certificate: "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members present again
     ipauser:
@@ -56,7 +56,7 @@
         - certificate: "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test certmapdata members absent
     ipauser:
@@ -70,7 +70,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members absent again
     ipauser:
@@ -84,7 +84,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test certmapdata members present
     ipauser:
@@ -100,7 +100,7 @@
           subject: CN=subject3
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members present again
     ipauser:
@@ -116,7 +116,7 @@
           subject: CN=subject3
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test certmapdata members absent
     ipauser:
@@ -133,7 +133,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test certmapdata members absent again
     ipauser:
@@ -150,7 +150,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User test absent
     ipauser:
@@ -159,7 +159,7 @@
       - name: test
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Remove certificate files.
     shell:
diff --git a/tests/user/test_user.yml b/tests/user/test_user.yml
index cca6b4894f115e20b19fa5ca563be97caa9457d8..5246d14cda0c036ab724035b2388dc8b31827c4d 100644
--- a/tests/user/test_user.yml
+++ b/tests/user/test_user.yml
@@ -18,7 +18,7 @@
       first: Manager
       last: One
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User manager2 present
     ipauser:
@@ -27,7 +27,7 @@
       first: Manager
       last: One
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User manager3 present
     ipauser:
@@ -36,7 +36,7 @@
       first: Manager
       last: One
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky present
     ipauser:
@@ -79,7 +79,7 @@
       #issuer: PinkyIssuer
       #subject: PinkySubject
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky present with changed settings
     ipauser:
@@ -93,7 +93,7 @@
       - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCqmVDpEX5gnSjKuv97AyzOhaUMMKz8ahOA3GY77tVC4o68KNgMCmDSEG1/kOIaElngNLaCha3p/2iAcU9Bi1tLKUlm2bbO5NHNwHfRxY/3cJtq+/7D1vxJzqThYwI4F9vr1WxyY2+mMTv3pXbfAJoR8Mu06XaEY5PDetlDKjHLuNWF+/O7ZU8PsULTa1dJZFrtXeFpmUoLoGxQBvlrlcPI1zDciCSU24t27Zan5Py2l5QchyI7yhCyMM77KDtj5+AFVpmkb9+zq50rYJAyFVeyUvwjzErvQrKJzYpA0NyBp7vskWbt36M16/M/LxEK7HA6mkcakO3ESWx5MT1LAjvdlnxbWG3787MxweHXuB8CZU+9bZPFBaJ+VQtOfJ7I8eH0S16moPC4ak8FlcFvOH8ERDPWLFDqfy09yaZ7bVIF0//5ZI7Nf3YDe3S7GrBX5ieYuECyP6UNkTx9BRsAQeVvXEc6otzB7iCSnYBMGUGzCqeigoAWaVQUONsSR3Uatks= pinky@ipaserver.el81.local
       - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDc8MIjaSrxLYHvu+hduoF4m6NUFSlXZWzYbd3BK4L47/U4eiXoOS6dcfuZJDjmLfOipc7XVp7NADwAgA1yBOAjbeVpXr2tC8w8saZibl75WBOEjDfNroiOh/f/ojrwwHg05QTVSZHs27sU1HBPyCQM/FHVM6EnRfmyiBkEBA/3ca0PJ9UJhWb2XisCaz6y6QcTh4gQnvHzgmEmK31GwiKnmBSEQuj8P5NGCO8RlN3cq3zpRpMDEoBRCjQYicllf/5P43r5OGvS1LhTiAMfyqE37URezNQa7aozBpH1GhIwAmjAtm84jXQjxUgZPYC0aSLuADYErScOP4792r6koH9t/DM5/M+jG2c4PNWynDczUw6Eaxl5E3hU0Ee9UN0Oee7iBnVenS/QMeZNyo5lMA/HXT5lrYiJGTYM0shRjGXXYBbJZhWerguSWDAdUd1gvuGP1nb7/+/Cvb46+HX7zYouS5Ojo0yPzMZ07X142jnKAfx9LnKdMUCwBJzbtoJ91Zc= pinky@ipaserver.el81.local
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky add manager manager1
     ipauser:
@@ -102,7 +102,7 @@
       manager: manager1
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky add manager manager1 again
     ipauser:
@@ -111,7 +111,7 @@
       manager: manager1
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User pinky add manager manager2, manager3
     ipauser:
@@ -120,7 +120,7 @@
       manager: manager2,manager3
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky add manager manager2, manager3 again
     ipauser:
@@ -129,7 +129,7 @@
       manager: manager2,manager3
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User pinky remove manager manager1
     ipauser:
@@ -139,7 +139,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky remove manager manager1 again
     ipauser:
@@ -149,7 +149,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User pinky add principal pa
     ipauser:
@@ -158,7 +158,7 @@
       principal: pa
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky add principal pa again
     ipauser:
@@ -167,7 +167,7 @@
       principal: pa
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User pinky add principal pa1
     ipauser:
@@ -176,7 +176,7 @@
       principal: pa1
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky remove principal pa1
     ipauser:
@@ -186,7 +186,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky remove principal pa1 again
     ipauser:
@@ -196,7 +196,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User pinky remove principal pa
     ipauser:
@@ -206,7 +206,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky remove principal non-existing pa2
     ipauser:
@@ -216,7 +216,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User pinky absent and preserved
     ipauser:
@@ -225,7 +225,7 @@
       preserve: yes
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky undeleted (preserved before)
     ipauser:
@@ -233,7 +233,7 @@
       name: pinky
       state: undeleted
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Users pinky disabled
     ipauser:
@@ -241,7 +241,7 @@
       name: pinky
       state: disabled
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky enabled
     ipauser:
@@ -249,7 +249,7 @@
       name: pinky
       state: enabled
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Remove test users
     ipauser:
diff --git a/tests/user/test_user_random.yml b/tests/user/test_user_random.yml
index 44b9373aa1475f6bb29c1eb615752f4442726d08..ce56abb020048f1a57c3484d2fdf951713e794df 100644
--- a/tests/user/test_user_random.yml
+++ b/tests/user/test_user_random.yml
@@ -22,7 +22,8 @@
       update_password: on_create
     register: ipauser
     failed_when: not ipauser.changed or
-                 ipauser.user.randompassword is not defined
+                 ipauser.user.randompassword is not defined or
+                 ipauser.failed
 
   - name: Print generated random password
     debug:
@@ -35,7 +36,7 @@
       - user1
       state: absent
 
-  - name: Users user1 and user1 present with random password
+  - name: Users user1 and user2 present with random password
     ipauser:
       ipaadmin_password: SomeADMINpassword
       users:
@@ -51,7 +52,8 @@
     register: ipauser
     failed_when: not ipauser.changed or
                  ipauser.user.user1.randompassword is not defined or
-                 ipauser.user.user2.randompassword is not defined
+                 ipauser.user.user2.randompassword is not defined or
+                 ipauser.failed
 
   - name: Print generated random password for user1
     debug:
diff --git a/tests/user/test_users.yml b/tests/user/test_users.yml
index 81c7b608826b1aea6af6b1e8e3ef256cdb422f98..65713931667b44e7d16f6cfc634cb3e98e8810f5 100644
--- a/tests/user/test_users.yml
+++ b/tests/user/test_users.yml
@@ -46,7 +46,7 @@
         first: user10
         last: Last
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Users user1..10 present
     ipauser:
@@ -83,8 +83,11 @@
         first: user10
         last: Last
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
+  # failed_when: not result.failed has been added as this test needs to
+  # fail because two users with the same name should be added in the same
+  # task.
   - name: Duplicate names in users failure test
     ipauser:
       ipaadmin_password: SomeADMINpassword
@@ -102,7 +105,7 @@
         first: user3
         last: Last
     register: result
-    failed_when: result.changed or "is used more than once" not in result.msg
+    failed_when: result.changed or not result.failed or "is used more than once" not in result.msg
 
   - name: Remove test users
     ipauser:
@@ -130,7 +133,7 @@
         first: Manager3
         last: One3
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky present
     ipauser:
@@ -173,7 +176,7 @@
       #issuer: PinkyIssuer
       #subject: PinkySubject
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Same user pinky present again
     ipauser:
@@ -216,7 +219,7 @@
       #issuer: PinkyIssuer
       #subject: PinkySubject
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User pinky present with changed settings
     ipauser:
@@ -230,7 +233,7 @@
       - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCqmVDpEX5gnSjKuv97AyzOhaUMMKz8ahOA3GY77tVC4o68KNgMCmDSEG1/kOIaElngNLaCha3p/2iAcU9Bi1tLKUlm2bbO5NHNwHfRxY/3cJtq+/7D1vxJzqThYwI4F9vr1WxyY2+mMTv3pXbfAJoR8Mu06XaEY5PDetlDKjHLuNWF+/O7ZU8PsULTa1dJZFrtXeFpmUoLoGxQBvlrlcPI1zDciCSU24t27Zan5Py2l5QchyI7yhCyMM77KDtj5+AFVpmkb9+zq50rYJAyFVeyUvwjzErvQrKJzYpA0NyBp7vskWbt36M16/M/LxEK7HA6mkcakO3ESWx5MT1LAjvdlnxbWG3787MxweHXuB8CZU+9bZPFBaJ+VQtOfJ7I8eH0S16moPC4ak8FlcFvOH8ERDPWLFDqfy09yaZ7bVIF0//5ZI7Nf3YDe3S7GrBX5ieYuECyP6UNkTx9BRsAQeVvXEc6otzB7iCSnYBMGUGzCqeigoAWaVQUONsSR3Uatks= pinky@ipaserver.el81.local
       - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDc8MIjaSrxLYHvu+hduoF4m6NUFSlXZWzYbd3BK4L47/U4eiXoOS6dcfuZJDjmLfOipc7XVp7NADwAgA1yBOAjbeVpXr2tC8w8saZibl75WBOEjDfNroiOh/f/ojrwwHg05QTVSZHs27sU1HBPyCQM/FHVM6EnRfmyiBkEBA/3ca0PJ9UJhWb2XisCaz6y6QcTh4gQnvHzgmEmK31GwiKnmBSEQuj8P5NGCO8RlN3cq3zpRpMDEoBRCjQYicllf/5P43r5OGvS1LhTiAMfyqE37URezNQa7aozBpH1GhIwAmjAtm84jXQjxUgZPYC0aSLuADYErScOP4792r6koH9t/DM5/M+jG2c4PNWynDczUw6Eaxl5E3hU0Ee9UN0Oee7iBnVenS/QMeZNyo5lMA/HXT5lrYiJGTYM0shRjGXXYBbJZhWerguSWDAdUd1gvuGP1nb7/+/Cvb46+HX7zYouS5Ojo0yPzMZ07X142jnKAfx9LnKdMUCwBJzbtoJ91Zc= pinky@ipaserver.el81.local
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky add manager manager1
     ipauser:
@@ -239,7 +242,7 @@
       manager: manager1
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky add manager manager1 again
     ipauser:
@@ -248,7 +251,7 @@
       manager: manager1
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User pinky add manager manager2, manager3
     ipauser:
@@ -257,7 +260,7 @@
       manager: manager2,manager3
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky add manager manager2, manager3 again
     ipauser:
@@ -266,7 +269,7 @@
       manager: manager2,manager3
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User pinky remove manager manager1
     ipauser:
@@ -276,7 +279,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky remove manager manager1 again
     ipauser:
@@ -286,7 +289,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User pinky add principal pa
     ipauser:
@@ -295,7 +298,7 @@
       principal: pa
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky add principal pa again
     ipauser:
@@ -304,7 +307,7 @@
       principal: pa
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User pinky add principal pa1
     ipauser:
@@ -313,7 +316,7 @@
       principal: pa1
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky remove principal pa1
     ipauser:
@@ -323,7 +326,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky remove principal pa1 again
     ipauser:
@@ -333,7 +336,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User pinky remove principal pa
     ipauser:
@@ -343,7 +346,7 @@
       action: member
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky remove principal non-existing pa2
     ipauser:
@@ -353,7 +356,7 @@
       action: member
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: User pinky absent and preserved
     ipauser:
@@ -362,7 +365,7 @@
       preserve: yes
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky undeleted (preserved before)
     ipauser:
@@ -370,7 +373,7 @@
       name: pinky
       state: undeleted
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Users pinky disabled
     ipauser:
@@ -378,7 +381,7 @@
       name: pinky
       state: disabled
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User pinky enabled
     ipauser:
@@ -386,7 +389,7 @@
       name: pinky
       state: enabled
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Remove test users
     ipauser:
diff --git a/tests/user/test_users_invalid_cert.yml b/tests/user/test_users_invalid_cert.yml
index d482d300325eb0db5f490a26df5c1cd0e08b4479..9139a54cb9bb31c3897502691ef5dd359ffefe26 100644
--- a/tests/user/test_users_invalid_cert.yml
+++ b/tests/user/test_users_invalid_cert.yml
@@ -39,7 +39,7 @@
         - "{{ lookup('file', 'cert1.b64', rstrip=False) }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: User test cert members absent
     ipauser:
@@ -52,7 +52,7 @@
       state: absent
       action: member
     #register: result
-    #failed_when: not result.changed
+    #failed_when: not result.changed or result.failed
 
   - name: Remove certificate files.
     shell:
diff --git a/tests/vault/tasks_vault_members.yml b/tests/vault/tasks_vault_members.yml
index e53acceec5d794fab7d61dd02dc222c7c47f4490..b293713ce10dfc2cc7e8bf3460f896358c12891a 100644
--- a/tests/vault/tasks_vault_members.yml
+++ b/tests/vault/tasks_vault_members.yml
@@ -9,7 +9,7 @@
       name: "{{vault.name}}"
       vault_type: "{{vault.vault_type}}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
     when: vault.vault_type == 'standard'
 
   - name: Ensure vault is present
@@ -19,7 +19,7 @@
       vault_password: SomeVAULTpassword
       vault_type: "{{vault.vault_type}}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
     when: vault.vault_type == 'symmetric'
 
   - name: Ensure vault is present
@@ -29,7 +29,7 @@
       vault_type: "{{ vault.vault_type }}"
       public_key: "{{lookup('file', 'A_private.b64')}}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
     when: vault.vault_type == 'asymmetric'
 
   - name: Ensure vault member user is present.
@@ -40,7 +40,7 @@
       users:
       - user02
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure vault member user is present, again.
     ipavault:
@@ -50,7 +50,7 @@
       users:
       - user02
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure more vault member users are present.
     ipavault:
@@ -61,7 +61,7 @@
       - admin
       - user02
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure vault member user is still present.
     ipavault:
@@ -71,7 +71,7 @@
       users:
       - user02
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure vault users are absent.
     ipavault:
@@ -83,7 +83,7 @@
       - user02
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure vault users are absent, again.
     ipavault:
@@ -95,7 +95,7 @@
       - user02
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure vault user is absent, once more.
     ipavault:
@@ -106,7 +106,7 @@
       - admin
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure vault member group is present.
     ipavault:
@@ -115,7 +115,7 @@
       action: member
       groups: vaultgroup
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure vault member group is present, again.
     ipavault:
@@ -124,7 +124,7 @@
       action: member
       groups: vaultgroup
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure vault member group is absent.
     ipavault:
@@ -134,7 +134,7 @@
       groups: vaultgroup
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure vault member group is absent, again.
     ipavault:
@@ -144,7 +144,7 @@
       groups: vaultgroup
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure vault member service is present.
     ipavault:
@@ -153,7 +153,7 @@
       action: member
       services: "HTTP/{{ ansible_facts['fqdn'] }}"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure vault member service is present, again.
     ipavault:
@@ -162,7 +162,7 @@
       action: member
       services: "HTTP/{{ ansible_facts['fqdn'] }}"
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure vault member service is absent.
     ipavault:
@@ -172,7 +172,7 @@
       services: "HTTP/{{ ansible_facts['fqdn'] }}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure vault member service is absent, again.
     ipavault:
@@ -182,7 +182,7 @@
       services: "HTTP/{{ ansible_facts['fqdn'] }}"
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure user03 is an owner of vault.
     ipavault:
@@ -191,7 +191,7 @@
       owners: user03
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure user03 is an owner of vault, again.
     ipavault:
@@ -200,7 +200,7 @@
       owners: user03
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure user03 is not owner of vault.
     ipavault:
@@ -210,7 +210,7 @@
       state: absent
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure user03 is not owner of vault, again.
     ipavault:
@@ -220,7 +220,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure vaultgroup is an ownergroup of vault.
     ipavault:
@@ -229,7 +229,7 @@
       ownergroups: vaultgroup
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure vaultgroup is an ownergroup of vault, again.
     ipavault:
@@ -238,7 +238,7 @@
       ownergroups: vaultgroup
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure vaultgroup is not ownergroup of vault.
     ipavault:
@@ -248,7 +248,7 @@
       state: absent
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure vaultgroup is not ownergroup of vault, again.
     ipavault:
@@ -258,7 +258,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure service is an owner of vault.
     ipavault:
@@ -267,7 +267,7 @@
       ownerservices: "HTTP/{{ ansible_facts['fqdn'] }}"
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure service is an owner of vault, again.
     ipavault:
@@ -276,7 +276,7 @@
       ownerservices: "HTTP/{{ ansible_facts['fqdn'] }}"
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure service is not owner of vault.
     ipavault:
@@ -286,7 +286,7 @@
       state: absent
       action: member
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure service is not owner of vault, again.
     ipavault:
@@ -296,7 +296,7 @@
       state: absent
       action: member
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure {{vault.vault_type}} vault is absent
     ipavault:
@@ -304,7 +304,7 @@
       name: "{{vault.name}}"
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure {{vault.vault_type}} vault is absent, again
     ipavault:
@@ -312,7 +312,7 @@
       name: "{{vault.name}}"
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Cleanup testing environment.
     import_tasks: env_cleanup.yml
diff --git a/tests/vault/test_vault_asymmetric.yml b/tests/vault/test_vault_asymmetric.yml
index 60e5ab8b4b36a16031003521848b9901cbec54a5..a757e7fd9c1b328b8b41d44d075325babc30a621 100644
--- a/tests/vault/test_vault_asymmetric.yml
+++ b/tests/vault/test_vault_asymmetric.yml
@@ -126,7 +126,7 @@
       name: asymvault
       vault_data: SomeADMINpassword
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Retrieve data from asymmetric vault.
     ipavault:
@@ -135,7 +135,7 @@
       private_key: "{{ lookup('file', 'B_private.b64') }}"
       state: retrieved
     register: result
-    failed_when: result.vault.data != 'SomeADMINpassword' or result.changed
+    failed_when: result.vault.data != 'SomeADMINpassword' or result.changed or result.failed
 
   - name: Change data in asymmetric vault
     ipavault:
@@ -143,7 +143,7 @@
       name: asymvault
       data: Hello World.
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Retrieve changed data from asymmetric vault.
     ipavault:
@@ -152,7 +152,7 @@
       private_key: "{{ lookup('file', 'B_private.b64') }}"
       state: retrieved
     register: result
-    failed_when: result.vault.data != 'Hello World.' or result.changed
+    failed_when: result.vault.data != 'Hello World.' or result.changed or result.failed
 
   - name: Retrieve data from asymmetric vault into file {{ ansible_facts['env'].HOME }}/data.txt.
     ipavault:
@@ -176,7 +176,7 @@
       name: asymvault
       data: The world of π is half rounded.
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Retrieve data from asymmetric vault.
     ipavault:
@@ -185,7 +185,7 @@
       private_key: "{{ lookup('file', 'B_private.b64') }}"
       state: retrieved
     register: result
-    failed_when: result.vault.data != 'The world of π is half rounded.' or result.changed
+    failed_when: result.vault.data != 'The world of π is half rounded.' or result.changed or result.failed
 
   - name: Archive data in asymmetric vault, from file.
     ipavault:
@@ -194,7 +194,7 @@
       vault_type: asymmetric
       in: "{{ ansible_facts['env'].HOME }}/in.txt"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Retrieve data from asymmetric vault.
     ipavault:
@@ -203,7 +203,7 @@
       private_key: "{{ lookup('file', 'B_private.b64') }}"
       state: retrieved
     register: result
-    failed_when: result.vault.data != 'Another World.' or result.changed
+    failed_when: result.vault.data != 'Another World.' or result.changed or result.failed
 
   - name: Archive data with single character to asymmetric vault
     ipavault:
@@ -211,7 +211,7 @@
       name: asymvault
       data: c
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Retrieve data from asymmetric vault.
     ipavault:
@@ -220,7 +220,7 @@
       private_key: "{{ lookup('file', 'B_private.b64') }}"
       state: retrieved
     register: result
-    failed_when: result.vault.data != 'c' or result.changed
+    failed_when: result.vault.data != 'c' or result.changed or result.failed
 
   - name: Ensure asymmetric vault is absent
     ipavault:
@@ -228,7 +228,7 @@
       name: asymvault
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure asymmetric vault is absent, again
     ipavault:
@@ -236,7 +236,7 @@
       name: asymvault
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Ensure asymmetric vault is present, with public key from file.
     ipavault:
@@ -245,7 +245,7 @@
       public_key_file: "{{ ansible_facts['env'].HOME }}/B_public.pem"
       vault_type: asymmetric
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure asymmetric vault is present, with password from file, again.
     ipavault:
@@ -254,7 +254,7 @@
       public_key_file: "{{ ansible_facts['env'].HOME }}/B_public.pem"
       vault_type: asymmetric
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Archive data to asymmetric vault
     ipavault:
@@ -262,7 +262,7 @@
       name: asymvault
       data: Hello World.
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Retrieve data from asymmetric vault.
     ipavault:
@@ -271,7 +271,7 @@
       private_key: "{{ lookup('file', 'B_private.b64') }}"
       state: retrieved
     register: result
-    failed_when: result.vault.data != 'Hello World.' or result.changed
+    failed_when: result.vault.data != 'Hello World.' or result.changed or result.failed
 
   - name: Retrieve data from asymmetric vault, with password file.
     ipavault:
@@ -280,7 +280,7 @@
       private_key_file: "{{ ansible_facts['env'].HOME }}/B_private.pem"
       state: retrieved
     register: result
-    failed_when: result.vault.data != 'Hello World.' or result.changed
+    failed_when: result.vault.data != 'Hello World.' or result.changed or result.failed
 
   - name: Ensure asymmetric vault is absent
     ipavault:
@@ -288,7 +288,7 @@
       name: asymvault
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure asymmetric vault is absent, again
     ipavault:
@@ -296,7 +296,7 @@
       name: asymvault
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Cleanup testing environment.
     import_tasks: env_cleanup.yml
diff --git a/tests/vault/test_vault_standard.yml b/tests/vault/test_vault_standard.yml
index 2cda5e1a7a09c79ad1aef2cbfc8a77ca9cd436fd..67aca2039feba07d8c6d819d36bae74918f1517d 100644
--- a/tests/vault/test_vault_standard.yml
+++ b/tests/vault/test_vault_standard.yml
@@ -15,7 +15,7 @@
       name: stdvault
       vault_type: standard
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure standard vault is present, again
     ipavault:
@@ -23,7 +23,7 @@
       name: stdvault
       vault_type: standard
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Archive data to standard vault, matching `no_log` field.
     ipavault:
@@ -31,7 +31,7 @@
       name: stdvault
       vault_data: SomeADMINpassword
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Retrieve data from standard vault.
     ipavault:
@@ -39,7 +39,7 @@
       name: stdvault
       state: retrieved
     register: result
-    failed_when: result.vault.data != 'SomeADMINpassword' or result.changed
+    failed_when: result.vault.data != 'SomeADMINpassword' or result.changed or result.failed
 
   - name: Archive data to standard vault
     ipavault:
@@ -47,7 +47,7 @@
       name: stdvault
       vault_data: Hello World.
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Retrieve data from standard vault.
     ipavault:
@@ -55,7 +55,7 @@
       name: stdvault
       state: retrieved
     register: result
-    failed_when: result.vault.data != 'Hello World.' or result.changed
+    failed_when: result.vault.data != 'Hello World.' or result.changed or result.failed
 
   - name: Retrieve data from standard vault into file {{ ansible_facts['env'].HOME }}/data.txt.
     ipavault:
@@ -78,7 +78,7 @@
       name: stdvault
       vault_data: The world of π is half rounded.
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Retrieve data from standard vault.
     ipavault:
@@ -86,7 +86,7 @@
       name: stdvault
       state: retrieved
     register: result
-    failed_when: result.vault.data != 'The world of π is half rounded.' or result.changed
+    failed_when: result.vault.data != 'The world of π is half rounded.' or result.changed or result.failed
 
   - name: Archive data in standard vault, from file.
     ipavault:
@@ -95,7 +95,7 @@
       vault_type: standard
       in: "{{ ansible_facts['env'].HOME }}/in.txt"
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Retrieve data from standard vault.
     ipavault:
@@ -103,7 +103,7 @@
       name: stdvault
       state: retrieved
     register: result
-    failed_when: result.vault.data != 'Another World.' or result.changed
+    failed_when: result.vault.data != 'Another World.' or result.changed or result.failed
 
   - name: Archive data with single character to standard vault
     ipavault:
@@ -111,7 +111,7 @@
       name: stdvault
       vault_data: c
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Retrieve data from standard vault.
     ipavault:
@@ -119,7 +119,7 @@
       name: stdvault
       state: retrieved
     register: result
-    failed_when: result.vault.data != 'c' or result.changed
+    failed_when: result.vault.data != 'c' or result.changed or result.failed
 
   - name: Ensure standard vault is absent
     ipavault:
@@ -127,7 +127,7 @@
       name: stdvault
       state: absent
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure standard vault is absent, again
     ipavault:
@@ -135,7 +135,7 @@
       name: stdvault
       state: absent
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Cleanup testing environment.
     import_tasks: env_cleanup.yml
diff --git a/tests/vault/test_vault_symmetric.yml b/tests/vault/test_vault_symmetric.yml
index fd85d06ede6e6233f272f89902cdfc5b40e67f75..0ae79349703d57afb7fcd93f4152885c1f5b1432 100644
--- a/tests/vault/test_vault_symmetric.yml
+++ b/tests/vault/test_vault_symmetric.yml
@@ -16,7 +16,7 @@
       vault_type: symmetric
       password: SomeVAULTpassword
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Ensure symmetric vault is present, again
     ipavault:
@@ -25,7 +25,7 @@
       vault_type: symmetric
       password: SomeVAULTpassword
     register: result
-    failed_when: result.changed
+    failed_when: result.changed or result.failed
 
   - name: Archive data to symmetric vault, matching `no_log` field.
     ipavault:
@@ -34,7 +34,7 @@
       vault_data: SomeADMINpassword
       password: SomeVAULTpassword
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Retrieve data from symmetric vault.
     ipavault:
@@ -52,7 +52,7 @@
       vault_data: Hello World.
       password: SomeVAULTpassword
     register: result
-    failed_when: not result.changed
+    failed_when: not result.changed or result.failed
 
   - name: Retrieve data from symmetric vault.
     ipavault: