diff --git a/ansible/playbooks/win_client.yml b/ansible/playbooks/win_client.yml new file mode 100644 index 0000000..82fad0c --- /dev/null +++ b/ansible/playbooks/win_client.yml @@ -0,0 +1,9 @@ +--- +- hosts: "meta-type_client" + gather_facts: false + vars_files: + - ../vars/common.yml + - ../vars/connection.yml + roles: + - role: win_client + tags: win_client \ No newline at end of file diff --git a/ansible/roles/win_client/tasks/chocolatey.yml b/ansible/roles/win_client/tasks/chocolatey.yml new file mode 100644 index 0000000..85513f8 --- /dev/null +++ b/ansible/roles/win_client/tasks/chocolatey.yml @@ -0,0 +1,112 @@ +--- +- name: Chocolatey + tags: client_chocolatey + block: + - name: Install Chocolatey + win_chocolatey: + name: Chocolatey + package_params: "'/Global'" + source: "{{ repo_url }}" + + - name: Add new internal Choco source (client machines) + win_chocolatey_source: + name: EPCC + state: present + source: "{{ repo_url }}" + + # https://github.com/chocolatey/chocolatey-ansible/issues/22 + #- name: Reboot after Chocolatey installation + # ansible.windows.win_reboot: + # reboot_timeout_sec: 1200 + # ??? + + - name: Disable the default public Choco source (client machines) + win_chocolatey_source: + name: chocolatey + state: disabled + +- name: Client Packages + tags: client_packages + block: + - name: Install Chocolatey GUI (client machines) + win_chocolatey: + name: ChocolateyGUI + state: present + package_params: "'/Global'" + + #- name: Install office365proplus (client machines) + # win_chocolatey: + # name: office365proplus + # state: present + # package_params: "'/Global /language:en-GB'" + # when: inventory_hostname in groups['meta-Tags_client'] + + - name: Install Firefox (client machines) + win_chocolatey: + name: firefox + state: present + + - name: Install R (client machines) + win_chocolatey: + name: R.Project + state: present + + #- name: Install Python3.10 (client machines) + # win_chocolatey: + # name: python310 + # state: present + # when: inventory_hostname in groups['meta-Tags_client'] + + - name: Install RStudio (client machines) + win_chocolatey: + name: r.studio + state: present + + - name: Install Other Software (client machines) + win_chocolatey: + name: "{{ item }}" + state: present + loop: + #- vscode.install + - vscode + #- KB4019990 + - python312 + - firefox + - notepadplusplus + - windirstat + - adobereader + - DotNet4.6 + - dotnet4.7.2 + # loop control ??? + + #- name: Install office365proplus (client machines) + # win_chocolatey: + # name: office365proplus + # state: present + # package_params: "'/Global /language:en-GB'" + # when: inventory_hostname in groups['meta-Tags_client'] + + + - name: Install veeam-agent (client machines) + win_chocolatey: + name: veeam-agent + state: present + + # I think Firefox adds one automatically... + #- name: Create Firefox shortcut on the desktop + # community.windows.win_shortcut: + # src: C:\Program Files\Mozilla Firefox\Firefox.exe + # dest: C:\Users\Public\Desktop\Mozilla Firefox.lnk + # icon: C:\Program Files\Mozilla Firefox\Firefox.exe,0 + + - name: Create RStudio shortcut on the desktop + community.windows.win_shortcut: + src: C:\Program Files\RStudio\rstudio.exe + dest: C:\Users\Public\Desktop\RSTudio.lnk + icon: C:\Program Files\RStudio\rstudio.exe,0 + + - name: Create ChocolateyGUI shortcut on the desktop + community.windows.win_shortcut: + src: C:\Program Files (x86)\Chocolatey GUI\ChocolateyGui.exe + dest: C:\Users\Public\Desktop\Install Software.lnk + icon: C:\Program Files (x86)\Chocolatey GUI\ChocolateyGui.exe,0 \ No newline at end of file diff --git a/ansible/roles/win_client/tasks/features.yml b/ansible/roles/win_client/tasks/features.yml new file mode 100644 index 0000000..bd1d020 --- /dev/null +++ b/ansible/roles/win_client/tasks/features.yml @@ -0,0 +1,37 @@ +--- +- name: Client Features + tags: client_features + block: + - name: Install client features + win_feature: + name: + - RDS-Connection-Broker + - RDS-RD-Server + - RDS-Web-Access + register: feature_status + + - name: Install client optional features + win_optional_feature: + name: NetFx4 + state: present + register: opt_feature_status + + - name: Rebooting Servers post feature installation + win_reboot: + reboot_timeout_sec: 1200 + when: feature_status.reboot_required == true or + opt_feature_status.reboot_required == true + +- name: Client Powershell + tags: client_powershell + block: + - name: Install NuGet packageprovider (requirement for GPRegistryPolicyDsc DSC module installation) + ansible.windows.win_powershell: + script: | + Find-PackageProvider -Name Nuget -ForceBootstrap -IncludeDependencies -Force + + - name: Install GPRegistryPolicyDsc DSC module + community.windows.win_psmodule: + name: GPRegistryPolicyDsc + state: Present + accept_license: true diff --git a/ansible/roles/win_client/tasks/main.yml b/ansible/roles/win_client/tasks/main.yml new file mode 100644 index 0000000..3a1d13c --- /dev/null +++ b/ansible/roles/win_client/tasks/main.yml @@ -0,0 +1,4 @@ +--- +- import_tasks: features.yml +- import_tasks: chocolatey.yml +- import_tasks: rd_gateway.yml \ No newline at end of file diff --git a/ansible/roles/win_client/tasks/rd_gateway.yml b/ansible/roles/win_client/tasks/rd_gateway.yml new file mode 100644 index 0000000..2b9bae4 --- /dev/null +++ b/ansible/roles/win_client/tasks/rd_gateway.yml @@ -0,0 +1,57 @@ +--- +- name: RD Gateway setup + tags: client_rdgw + block: + - name: Local policy for 'Remote Desktop Users' group to log on through Remote Desktop Services + ansible.windows.win_user_right: + name: SeRemoteInteractiveLogonRight + users: + - Remote Desktop Users + action: add + + # https://exchangepedia.com/2016/10/enable-remote-desktop-rdp-connections-for-admins-on-windows-server-2016.html + - name: Registry edit - fDenyTSConnections + ansible.windows.win_dsc: + resource_name: Registry + Ensure: Present + Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server + ValueName: fDenyTSConnections + ValueData: 0 + PsDscRunAsCredential_username: Administrator + PsDscRunAsCredential_password: "{{ ansible_password }}" + + - name: Registry edit - fSingleSessionPerUser + ansible.windows.win_dsc: + resource_name: Registry + Ensure: Present + Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server + ValueName: fSingleSessionPerUser + ValueData: 1 + PsDscRunAsCredential_username: Administrator + PsDscRunAsCredential_password: "{{ ansible_password }}" + + - name: Registry edit - SecurityLayer + ansible.windows.win_dsc: + resource_name: Registry + Ensure: Present + Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server + ValueName: SecurityLayer + ValueData: 0 + PsDscRunAsCredential_username: Administrator + PsDscRunAsCredential_password: "{{ ansible_password }}" + + - name: Registry edit - UserAuthentication + ansible.windows.win_dsc: + resource_name: Registry + Ensure: Present + Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp + ValueName: UserAuthentication + ValueData: 0 + PsDscRunAsCredential_username: Administrator + PsDscRunAsCredential_password: "{{ ansible_password }}" + + - name: Enable NetFireWallRule - “Remote Desktop” + tags: temp + ansible.windows.win_powershell: + script: | + Enable-NetFirewallRule -DisplayGroup “Remote Desktop” diff --git a/ansible/roles/win_client/vars/main.yml b/ansible/roles/win_client/vars/main.yml new file mode 100644 index 0000000..01371eb --- /dev/null +++ b/ansible/roles/win_client/vars/main.yml @@ -0,0 +1 @@ +repo_url: 'http://{{ win_project }}-choc.{{ win_project }}.loc/chocolatey' \ No newline at end of file