win_client role

ansible/playbooks/win_client.yml

@@ -0,0 +1,9 @@
+---
+- hosts: "meta-type_client"
+  gather_facts: false
+  vars_files:
+    - ../vars/common.yml
+    - ../vars/connection.yml
+  roles:
+    - role: win_client
+      tags: win_client

ansible/roles/win_client/tasks/chocolatey.yml

@@ -0,0 +1,112 @@
+---
+- name: Chocolatey
+  tags: client_chocolatey
+  block:
+    - name: Install Chocolatey
+      win_chocolatey:
+        name: Chocolatey
+        package_params: "'/Global'"
+        source: "{{ repo_url }}"
+
+    - name: Add new internal Choco source (client machines)
+      win_chocolatey_source:
+         name: EPCC 
+         state: present
+         source: "{{ repo_url }}"
+
+    # https://github.com/chocolatey/chocolatey-ansible/issues/22
+    #- name: Reboot after Chocolatey installation
+    #  ansible.windows.win_reboot:
+    #    reboot_timeout_sec: 1200
+    # ???
+
+    - name: Disable the default public Choco source (client machines)
+      win_chocolatey_source:
+          name: chocolatey
+          state: disabled
+
+- name: Client Packages
+  tags: client_packages
+  block:      
+    - name: Install Chocolatey GUI (client machines)
+      win_chocolatey:
+        name: ChocolateyGUI
+        state: present
+        package_params: "'/Global'"
+
+    #- name: Install office365proplus (client machines)
+    #  win_chocolatey:
+    #    name: office365proplus
+    #    state: present
+    #    package_params: "'/Global /language:en-GB'"
+    #  when: inventory_hostname in groups['meta-Tags_client']
+
+    - name: Install Firefox (client machines)
+      win_chocolatey:
+        name: firefox
+        state: present
+
+    - name: Install R (client machines)
+      win_chocolatey:
+        name: R.Project
+        state: present
+
+    #- name: Install Python3.10 (client machines)
+    #  win_chocolatey:
+    #    name: python310
+    #    state: present
+    #  when: inventory_hostname in groups['meta-Tags_client']
+
+    - name: Install RStudio (client machines)
+      win_chocolatey:
+        name: r.studio
+        state: present
+
+    - name: Install Other Software (client machines)
+      win_chocolatey:
+        name: "{{ item }}"
+        state: present
+      loop:
+        #- vscode.install
+        - vscode
+        #- KB4019990
+        - python312
+        - firefox
+        - notepadplusplus
+        - windirstat
+        - adobereader
+        - DotNet4.6
+        - dotnet4.7.2
+      # loop control ???
+
+    #- name: Install office365proplus (client machines)
+    #  win_chocolatey:
+    #    name: office365proplus
+    #    state: present
+    #    package_params: "'/Global /language:en-GB'"
+    #  when: inventory_hostname in groups['meta-Tags_client']
+
+
+    - name: Install veeam-agent (client machines)
+      win_chocolatey:
+        name: veeam-agent
+        state: present
+
+    # I think Firefox adds one automatically...
+    #- name: Create Firefox shortcut on the desktop
+    #  community.windows.win_shortcut:
+    #    src: C:\Program Files\Mozilla Firefox\Firefox.exe
+    #    dest: C:\Users\Public\Desktop\Mozilla Firefox.lnk
+    #    icon: C:\Program Files\Mozilla Firefox\Firefox.exe,0
+
+    - name: Create RStudio shortcut on the desktop
+      community.windows.win_shortcut:
+        src: C:\Program Files\RStudio\rstudio.exe
+        dest: C:\Users\Public\Desktop\RSTudio.lnk
+        icon: C:\Program Files\RStudio\rstudio.exe,0
+
+    - name: Create ChocolateyGUI shortcut on the desktop
+      community.windows.win_shortcut:
+        src: C:\Program Files (x86)\Chocolatey GUI\ChocolateyGui.exe
+        dest: C:\Users\Public\Desktop\Install Software.lnk
+        icon: C:\Program Files (x86)\Chocolatey GUI\ChocolateyGui.exe,0

ansible/roles/win_client/tasks/features.yml

@@ -0,0 +1,37 @@
+---
+- name: Client Features
+  tags: client_features
+  block:
+    - name: Install client features
+      win_feature:
+        name:
+          - RDS-Connection-Broker
+          - RDS-RD-Server
+          - RDS-Web-Access
+      register: feature_status
+
+    - name: Install client optional features
+      win_optional_feature:
+        name: NetFx4
+        state: present
+      register: opt_feature_status
+
+    - name: Rebooting Servers post feature installation
+      win_reboot:
+        reboot_timeout_sec: 1200
+      when: feature_status.reboot_required == true or
+            opt_feature_status.reboot_required == true
+
+- name: Client Powershell
+  tags: client_powershell
+  block:
+    - name: Install NuGet packageprovider (requirement for GPRegistryPolicyDsc DSC module installation)
+      ansible.windows.win_powershell:
+        script: |
+          Find-PackageProvider -Name Nuget -ForceBootstrap -IncludeDependencies -Force
+
+    - name: Install GPRegistryPolicyDsc DSC module
+      community.windows.win_psmodule:
+        name: GPRegistryPolicyDsc
+        state: Present
+        accept_license: true

ansible/roles/win_client/tasks/main.yml

@@ -0,0 +1,4 @@
+---
+- import_tasks: features.yml
+- import_tasks: chocolatey.yml
+- import_tasks: rd_gateway.yml

ansible/roles/win_client/tasks/rd_gateway.yml

@@ -0,0 +1,57 @@
+---
+- name: RD Gateway setup
+  tags: client_rdgw
+  block:
+    - name: Local policy for 'Remote Desktop Users' group to log on through Remote Desktop Services
+      ansible.windows.win_user_right:
+        name: SeRemoteInteractiveLogonRight
+        users:
+          - Remote Desktop Users
+        action: add
+
+    # https://exchangepedia.com/2016/10/enable-remote-desktop-rdp-connections-for-admins-on-windows-server-2016.html
+    - name: Registry edit - fDenyTSConnections
+      ansible.windows.win_dsc:
+        resource_name: Registry
+        Ensure: Present
+        Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
+        ValueName: fDenyTSConnections
+        ValueData: 0
+        PsDscRunAsCredential_username: Administrator
+        PsDscRunAsCredential_password: "{{ ansible_password }}"
+
+    - name: Registry edit - fSingleSessionPerUser
+      ansible.windows.win_dsc:
+        resource_name: Registry
+        Ensure: Present
+        Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
+        ValueName: fSingleSessionPerUser
+        ValueData: 1
+        PsDscRunAsCredential_username: Administrator
+        PsDscRunAsCredential_password: "{{ ansible_password }}"
+
+    - name: Registry edit - SecurityLayer
+      ansible.windows.win_dsc:
+        resource_name: Registry
+        Ensure: Present
+        Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
+        ValueName: SecurityLayer
+        ValueData: 0
+        PsDscRunAsCredential_username: Administrator
+        PsDscRunAsCredential_password: "{{ ansible_password }}"
+
+    - name: Registry edit - UserAuthentication
+      ansible.windows.win_dsc:
+        resource_name: Registry
+        Ensure: Present
+        Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
+        ValueName: UserAuthentication
+        ValueData: 0
+        PsDscRunAsCredential_username: Administrator
+        PsDscRunAsCredential_password: "{{ ansible_password }}"
+
+    - name: Enable NetFireWallRule -  “Remote Desktop”
+      tags: temp
+      ansible.windows.win_powershell:
+        script: |
+          Enable-NetFirewallRule -DisplayGroup “Remote Desktop”

ansible/roles/win_client/vars/main.yml

@@ -0,0 +1 @@
+repo_url: 'http://{{ win_project }}-choc.{{ win_project }}.loc/chocolatey'