diff --git a/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 b/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 index b0cb5b5..ec7aeae 100644 --- a/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 +++ b/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 @@ -35,8 +35,12 @@ write-host 'Installing .Net Framework 3.5' Install-WindowsFeature -name NET-Framework-Core } -sl "C:\Program Files\Update Services\Tools" -.\wsusutil.exe postinstall CONTENT_DIR=$WSUSDir +if (Test-Path -Path $WSUSDir) { + Write-Host 'Content Directory Exists' +} else { + sl "C:\Program Files\Update Services\Tools" + .\wsusutil.exe postinstall CONTENT_DIR=$WSUSDir +} # Get WSUS Server Object $wsus = Get-WSUSServer @@ -80,11 +84,7 @@ Get-WsusProduct | where-Object { '.NET 8.0', '.NET Core 2.1', '.NET Core 3.1', - 'Active Directory Rights Management Services Client 2.0', 'Active Directory', - 'Developer Tools, Runtimes, and Redistributables', - 'Dictionary Updates for Microsoft IMEs', - 'Kernel Updates', 'Microsoft 365 Apps/Office 2019/Office LTSC', 'Microsoft Defender Antivirus', 'Microsoft Security Essentials', @@ -92,7 +92,6 @@ Get-WsusProduct | where-Object { 'Microsoft Server Operating System-22H2', 'Microsoft Server Operating System-23H2', 'Microsoft Server Operating System-24H2', - 'Microsoft SQL Server 2008 R2 - PowerPivot for Microsoft Excel 2010', 'Microsoft SQL Server 2012', 'Microsoft SQL Server 2014', 'Microsoft SQL Server 2016', @@ -103,33 +102,13 @@ Get-WsusProduct | where-Object { 'Microsoft SQL Server Management Studio v18', 'Microsoft SQL Server Management Studio v19', 'Microsoft SQL Server Management Studio v20', - 'Microsoft SQL Server PowerPivot for Excel', 'MS Security Essentials', - 'Office 2013', - 'Office 2016', - 'Office Communications Server And Office Communicator', - 'Office Communicator 2007 R2', - 'Office Live Add-in', - 'Office Live', - 'Office', 'PowerShell - x64', - 'PowerShell Preview - x64', 'PowerShell', - 'Remote help', - 'Report Viewer 2005', - 'Report Viewer 2008', - 'Report Viewer 2010', - 'Search Enhancement Pack', 'Security Essentials', 'Server 2022 Hotpatch Category', - 'Service Bus for Windows Server 1.1', 'Silverlight', 'Silverlight', - 'Visual Studio 2005', - 'Visual Studio 2008', - 'Visual Studio 2010 Tools for Office Runtime', - 'Visual Studio 2010 Tools for Office Runtime', - 'Visual Studio 2010', 'Visual Studio 2012', 'Visual Studio 2013', 'Visual Studio 2015 Update 3', @@ -137,21 +116,11 @@ Get-WsusProduct | where-Object { 'Visual Studio 2017', 'Visual Studio 2019', 'Visual Studio 2022', - 'Windows - Client S, version 21H2 and later, Servicing Drivers', - 'Windows - Client S, version 21H2 and later, Upgrade & Servicing Drivers', - 'Windows - Client, version 21H2 and later, Servicing Drivers', - 'Windows - Client, version 21H2 and later, Upgrade & Servicing Drivers', + 'Windows Admin Center', 'Windows - Server, version 21H2 and later, Servicing Drivers', 'Windows - Server, version 21H2 and later, Upgrade & Servicing Drivers', 'Windows - Server, version 24H2 and later, Upgrade & Servicing Drivers', 'Windows Dictionary Updates', - 'Windows GDR-Dynamic Update', - 'Windows Insider Pre-Release', - 'Windows Media Dynamic Installer', - 'Windows Next Graphics Driver Dynamic update', - 'Windows RT 8.1', - 'Windows RT', - 'Windows Safe OS Dynamic Update', 'Windows Security platform', 'Windows Server 2019 and later, Servicing Drivers', 'Windows Server 2019 and later, Upgrade & Servicing Drivers', @@ -159,11 +128,13 @@ Get-WsusProduct | where-Object { 'Windows Server 2019', 'Windows Server Drivers', 'Windows Server Manager Windows Server Update Services (WSUS) Dynamic Installer', - 'Windows Server Solutions Best Practices Analyzer 1.0', 'Windows Server Technical Preview Language Packs', 'Windows Server, version 1903 and later') } | Set-WsusProduct +Get-WsusProduct | where-Object { $_.Product.Title -eq 'Windows' } | Set-WsusProduct -Disable +Get-WsusProduct | where-Object { $_.Product.Title -eq 'Developer Tools, Runtimes, and Redistributables' } | Set-WsusProduct -Disable + # Configure the Classifications write-host 'Setting WSUS Classifications' Get-WsusClassification | Where-Object { @@ -241,5 +212,5 @@ $rule.Enabled = $True $rule.Save() } - +$Apply = $rule.ApplyRule() diff --git a/ansible/roles/win_wsus/tasks/configure.yml b/ansible/roles/win_wsus/tasks/configure.yml index 8b9e7b2..cc328a3 100644 --- a/ansible/roles/win_wsus/tasks/configure.yml +++ b/ansible/roles/win_wsus/tasks/configure.yml @@ -2,16 +2,18 @@ - name: Configure WSUS server tags: configure_wsus block: - #- name: Ensure Content directory exists - # win_file: + #- name: Check if Content directory already exists + # win_stat: # path: "{{ wsus_content_directory }}" - # state: directory + # register: folder + # failed_when: folder.stat.exists #- name: Set WSUS Content Directory # tags: set_wsus_content_dir # win_shell: | # CD "C:\Program Files\Update Services\Tools" - # .\wsusutil.exe postinstall CONTENT_DIR=W:\WSUS + # .\wsusutil.exe postinstall CONTENT_DIR={{ wsus_content_directory }} + # when: not folder.stat.exists - name: WSUS Script tags: wsus_script @@ -27,93 +29,3 @@ #win_shell: "powershell {{ script_dir }}\\{{ wsus_script }}" #tags: apply_wsus_script - - -#- name: Ensure WSUS server is deployed (UpdateServicesDSC) - Errors here :( -# tags: testing -# win_dsc: -# resource_name: UpdateServicesServer -# Ensure: Present -# ContentDir: '{{ wsus_content_directory }}' -# Languages: en -# #Products: "{{ wsus_products }}" -# Products: "Windows Admin Center" -# PsDscRunAsCredential_username: Administrator -# PsDscRunAsCredential_password: "{{ ansible_password }}" -# #ErrorRecord: test -# Classifications: -# - "{{ CriticalUpdates }}" -# #- "{{ DefinitionUpdates }}" -# #- "{{ SecurityUpdates }}" -# #- "{{ ServicePacks }}" -# #- "{{ UpdateRollups }}" -# #- "{{ Updates }}" -# #Synchronize: True -# SynchronizeAutomatically: True -# SynchronizeAutomaticallyTimeOfDay: '15:30:00' -# ClientTargetingMode: "{{ wsus_client_targeting_mode }}" - - - - - - -##- name: Configure WSUS server -## block: -## - name: Ensure Content directory exists -## win_file: -## path: '{{ wsus_content_dir }}' -## state: directory -## - name: Ensure WSUS server is deployed (UpdateServicesDSC) - Errors here :( -## win_dsc: -## resource_name: UpdateServicesServer -## Ensure: Present -## ContentDir: '{{ wsus_content_dir }}' -## Languages: en -## Products: "{{ wsus_products }}" -## Classifications: -## - "{{ wsus_category_names['CriticalUpdates'].id }}" -## #- "{{ wsus_category_names['DefinitionUpdates'].id }}" -## #- "{{ wsus_category_names['SecurityUpdates'].id }}" -## #- "{{ wsus_category_names['ServicePacks'].id }}" -## #- "{{ wsus_category_names['UpdateRollups'].id }}" -## #- "{{ wsus_category_names['Updates'].id }}" -## # Ignore upstream as we don't have one yet... -## #UpstreamServerName: "{{ wsus_upstream_server_name | default(omit) }}" -## #UpstreamServerPort: "{{ wsus_upstream_server_port | default(omit) }}" -## #UpstreamServerSSL: "{{ wsus_upstream_server_ssl | default(omit) }}" -## Synchronize: True -## SynchronizeAutomatically: True -## SynchronizeAutomaticallyTimeOfDay: '01:30:00' -## ClientTargetingMode: "{{ wsus_client_targeting_mode }}" -## ignore_errors: true -## retries: 2 -## - name: Apply approval rules (UpdateServicesDSC) -## win_dsc: -## resource_name: UpdateServicesApprovalRule -## Name: "{{ wsus_category_names[item].name }}" -## Classifications: "{{ wsus_category_names[item].id }}" -## Enabled: True -## RunRuleNow: True -## loop: -## - CriticalUpdates -## #- DefinitionUpdates -## #- SecurityUpdates -## #- ServicePacks -## #- UpdateRollups -## #- Updates -## - name: Clean up updates (UpdateServicesDSC) -## win_dsc: -## resource_name: UpdateServicesCleanup -## Ensure: Present -## DeclineExpiredUpdates: True -## DeclineSupersededUpdates: True -## CleanupObsoleteUpdates: True -## CleanupUnneededContentFiles: True -## # Might be handy: https://github.com/slopez888/vsphere-ansible/blob/master/roles/wsus-server-configure/tasks/max_xml_per_request.yml -## - name: obtain WSUS DB name -## win_reg_stat: -## path: HKLM:\SOFTWARE\Microsoft\Update Services\Server\Setup -## name: SqlDatabaseName -## register: wsus_db_name -## when: inventory_hostname in groups['meta-Tags_wsus']