tweaks for new VM creation

ansible/roles/win_client/tasks/rdgw.yml

@@ -7,6 +7,15 @@
     state: present
   tags: guacamole_rdu
 
+- name: Add Docker group to docker-users
+  ansible.windows.win_group_membership:
+    name: docker-users
+    members:
+      - "{{ win_project}}\\{{ docker_user_group }}"
+    state: present
+  ignore_errors: true
+  tags: docker_access
+
 - name: RD Gateway setup
   tags: client_rdgw
   block:
@@ -25,7 +34,7 @@
         Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
         ValueName: fDenyTSConnections
         ValueData: 0
-        PsDscRunAsCredential_username: Administrator
+        PsDscRunAsCredential_username: "{{ domain_administrator }}"
         PsDscRunAsCredential_password: "{{ ansible_password }}"
 
     - name: Registry edit - fSingleSessionPerUser
@@ -35,7 +44,7 @@
         Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
         ValueName: fSingleSessionPerUser
         ValueData: 1
-        PsDscRunAsCredential_username: Administrator
+        PsDscRunAsCredential_username: "{{ domain_administrator }}"
         PsDscRunAsCredential_password: "{{ ansible_password }}"
 
     - name: Registry edit - SecurityLayer
@@ -45,7 +54,7 @@
         Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
         ValueName: SecurityLayer
         ValueData: 0
-        PsDscRunAsCredential_username: Administrator
+        PsDscRunAsCredential_username: "{{ domain_administrator }}"
         PsDscRunAsCredential_password: "{{ ansible_password }}"
 
     - name: Registry edit - UserAuthentication
@@ -55,7 +64,7 @@
         Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
         ValueName: UserAuthentication
         ValueData: 0
-        PsDscRunAsCredential_username: Administrator
+        PsDscRunAsCredential_username: "{{ domain_administrator }}"
         PsDscRunAsCredential_password: "{{ ansible_password }}"
 
     - name: Enable NetFireWallRule -  “Remote Desktop”

ansible/roles/win_domain_controller/defaults/main.yml

@@ -1 +1,2 @@
 guacamole_user_group: "Guacamole Users"
+docker_user_group: "Docker Users"

ansible/roles/win_domain_controller/tasks/setup.yml

@@ -56,7 +56,7 @@
     - name: Promote DC02 to domain controller
       microsoft.ad.domain_controller:
         dns_domain_name: "{{ win_project }}.loc"
-        domain_admin_user: "Administrator@{{ win_project }}.loc"
+        domain_admin_user: "{{ domain_administrator }}@{{ win_project }}.loc"
         domain_admin_password: "{{ ansible_password }}"
         safe_mode_password: "{{ safemode_password }}"
         state: domain_controller
@@ -70,7 +70,7 @@
     - name: Promote DC02 to domain controller
       microsoft.ad.domain_controller:
         dns_domain_name: "{{ win_project }}.loc"
-        domain_admin_user: "Administrator@{{ win_project }}.loc"
+        domain_admin_user: "{{ domain_administrator }}@{{ win_project }}.loc"
         domain_admin_password: "{{ ansible_password }}"
         safe_mode_password: "{{ safemode_password }}"
         state: domain_controller
@@ -131,6 +131,14 @@
         path: "cn=Users,dc={{ win_project }},dc=loc"
         scope: domainlocal
         category: security
+
+    - name: Create Docker Users group for Docker Desktop access
+      microsoft.ad.group:
+        name: "{{ docker_user_group }}"
+        description: "Allow docker desktop access for docker users"
+        path: "cn=Users,dc={{ win_project }},dc=loc"
+        scope: domainlocal
+        category: security
   when: inventory_hostname in groups['meta-name_dc01']
 
 

ansible/roles/win_initial/tasks/initial.yml

@@ -87,7 +87,7 @@
   block: 
     - name: Change Administrator password
       win_user:
-        name: Administrator
+        name: "{{ domain_administrator }}"
         password: "{{ vm_password }}"
 
     - name: Set Password Status

ansible/roles/win_user/defaults/main.yml

@@ -1,2 +1,3 @@
 user_action: create
 guacamole_user_group: "Guacamole Users"
+docker_user_group: "Docker Users"

ansible/roles/win_user/tasks/create.yml

@@ -12,6 +12,7 @@
           add:
             - "{{ study_code }}"
             - "{{ guacamole_user_group }}"
+            - "{{ docker_user_group }}"
         email: "{{ email }}"
         attributes:
           add:

ansible/roles/win_vms/defaults/main.yml

@@ -1 +1,5 @@
 cleanup: false
+state: present
+new_wb_quantity: 0
+new_app_quantity: 0
+new_gpu_quantity: 0

ansible/vars/common.yml

@@ -27,6 +27,8 @@ filetransfer_user: file-transfer
 filemanager_user: file-manager
 
 guacamole_user_group: "Guacamole Users"
+docker_user_group: "Docker Users"
+domain_administrator: "Administrator"
 
 winrm_script_url: http://10.24.3.242/ConfigureRemotingForAnsible.ps1