---
- name: Lock the root account
  become: true
  ansible.builtin.user:
    name: root
    password_lock: true
  no_log: true
  tags:
    - users
    - lock_root
...