diff --git a/ansible/roles/win_wsus/files/setup_wsus.ps1 b/ansible/roles/win_wsus/files/setup_wsus.ps1 deleted file mode 120000 index ad77cdd..0000000 --- a/ansible/roles/win_wsus/files/setup_wsus.ps1 +++ /dev/null @@ -1 +0,0 @@ -setup_wsus_v1.0.ps1 \ No newline at end of file diff --git a/ansible/roles/win_wsus/files/setup_wsus_v1.0.ps1 b/ansible/roles/win_wsus/files/setup_wsus_v1.0.ps1 deleted file mode 100644 index e69de29..0000000 diff --git a/ansible/roles/win_wsus/files/wsus_setup.ps1 b/ansible/roles/win_wsus/files/wsus_setup.ps1 new file mode 120000 index 0000000..6a4d57f --- /dev/null +++ b/ansible/roles/win_wsus/files/wsus_setup.ps1 @@ -0,0 +1 @@ +wsus_setup_v1.0.ps1 \ No newline at end of file diff --git a/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 b/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 new file mode 100644 index 0000000..b0cb5b5 --- /dev/null +++ b/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 @@ -0,0 +1,245 @@ +############### +## Variables ## +############### + +##//INSTALLATION//## + +# Do you want to install .NET FRAMEWORK 3.5? If true, provide a location for the Windows OS media in the next variable + $DotNet = $True +# Do you want to download and install MS Report Viewer 2008 SP1 (required for WSUS Reports)? + $RepViewer = $True +# WSUS Installation Type. Enter "WID" (for WIndows Internal Database), "SQLExpress" (to download and install a local SQLExpress), or "SQLRemote" (for an existing SQL Instance). + $WSUSType = "WID" +# Location to store WSUS Updates (will be created if doesn't exist) + $WSUSDir = "W:\WSUS" +# Temporary location for installation files (will be created if doesn't exist) + $TempDir = "W:\temp" + +##//CONFIGURATION//## + +# Do you want to configure WSUS (equivalent of WSUS Configuration Wizard, plus some additional options)? If $false, no further variables apply. +# You can customise the configurations, such as Products and Classifications etc, in the "Begin Initial Configuration of WSUS" section of the script. + $ConfigureWSUS = $True +# Do you want to decline some unwanted updates? + $DeclineUpdates = $True +# Do you want to configure and enable the Default Approval Rule? + $DefaultApproval = $True +# Do you want to run the Default Approval Rule after configuring? + $RunDefaultRule = $False + + +# Install .Net Framework 3.5 +if($DotNet -eq $true) +{ +write-host 'Installing .Net Framework 3.5' +Install-WindowsFeature -name NET-Framework-Core +} + +sl "C:\Program Files\Update Services\Tools" +.\wsusutil.exe postinstall CONTENT_DIR=$WSUSDir + +# Get WSUS Server Object +$wsus = Get-WSUSServer + +# Connect to WSUS server configuration +$wsusConfig = $wsus.GetConfiguration() + +# Set to download updates from Microsoft Updates +Set-WsusServerSynchronization -SyncFromMU + +# Set Update Languages to English and save configuration settings +$wsusConfig.AllUpdateLanguagesEnabled = $false +$wsusConfig.SetEnabledUpdateLanguages("en") +$wsusConfig.Save() + + + + +# Get WSUS Subscription and perform initial synchronization to get latest categories +$subscription = $wsus.GetSubscription() +$subscription.StartSynchronizationForCategoryOnly() +write-host 'Beginning first WSUS Sync to get available Products etc' -ForegroundColor Magenta +write-host 'Will take some time to complete' +While ($subscription.GetSynchronizationStatus() -ne 'NotProcessing') { + Write-Host "." -NoNewline + Start-Sleep -Seconds 5 +} +write-host ' ' +Write-Host "Sync is done." -ForegroundColor Green + + + + +# Configure the Platforms that we want WSUS to receive updates +write-host 'Setting WSUS Products' +Get-WsusProduct | where-Object { + $_.Product.Title -in ( + '.NET 5.0', + '.NET 6.0', + '.NET 7.0', + '.NET 8.0', + '.NET Core 2.1', + '.NET Core 3.1', + 'Active Directory Rights Management Services Client 2.0', + 'Active Directory', + 'Developer Tools, Runtimes, and Redistributables', + 'Dictionary Updates for Microsoft IMEs', + 'Kernel Updates', + 'Microsoft 365 Apps/Office 2019/Office LTSC', + 'Microsoft Defender Antivirus', + 'Microsoft Security Essentials', + 'Microsoft Server operating system-21H2', + 'Microsoft Server Operating System-22H2', + 'Microsoft Server Operating System-23H2', + 'Microsoft Server Operating System-24H2', + 'Microsoft SQL Server 2008 R2 - PowerPivot for Microsoft Excel 2010', + 'Microsoft SQL Server 2012', + 'Microsoft SQL Server 2014', + 'Microsoft SQL Server 2016', + 'Microsoft SQL Server 2017', + 'Microsoft SQL Server 2019', + 'Microsoft SQL Server 2022', + 'Microsoft SQL Server Management Studio v17', + 'Microsoft SQL Server Management Studio v18', + 'Microsoft SQL Server Management Studio v19', + 'Microsoft SQL Server Management Studio v20', + 'Microsoft SQL Server PowerPivot for Excel', + 'MS Security Essentials', + 'Office 2013', + 'Office 2016', + 'Office Communications Server And Office Communicator', + 'Office Communicator 2007 R2', + 'Office Live Add-in', + 'Office Live', + 'Office', + 'PowerShell - x64', + 'PowerShell Preview - x64', + 'PowerShell', + 'Remote help', + 'Report Viewer 2005', + 'Report Viewer 2008', + 'Report Viewer 2010', + 'Search Enhancement Pack', + 'Security Essentials', + 'Server 2022 Hotpatch Category', + 'Service Bus for Windows Server 1.1', + 'Silverlight', + 'Silverlight', + 'Visual Studio 2005', + 'Visual Studio 2008', + 'Visual Studio 2010 Tools for Office Runtime', + 'Visual Studio 2010 Tools for Office Runtime', + 'Visual Studio 2010', + 'Visual Studio 2012', + 'Visual Studio 2013', + 'Visual Studio 2015 Update 3', + 'Visual Studio 2015', + 'Visual Studio 2017', + 'Visual Studio 2019', + 'Visual Studio 2022', + 'Windows - Client S, version 21H2 and later, Servicing Drivers', + 'Windows - Client S, version 21H2 and later, Upgrade & Servicing Drivers', + 'Windows - Client, version 21H2 and later, Servicing Drivers', + 'Windows - Client, version 21H2 and later, Upgrade & Servicing Drivers', + 'Windows - Server, version 21H2 and later, Servicing Drivers', + 'Windows - Server, version 21H2 and later, Upgrade & Servicing Drivers', + 'Windows - Server, version 24H2 and later, Upgrade & Servicing Drivers', + 'Windows Dictionary Updates', + 'Windows GDR-Dynamic Update', + 'Windows Insider Pre-Release', + 'Windows Media Dynamic Installer', + 'Windows Next Graphics Driver Dynamic update', + 'Windows RT 8.1', + 'Windows RT', + 'Windows Safe OS Dynamic Update', + 'Windows Security platform', + 'Windows Server 2019 and later, Servicing Drivers', + 'Windows Server 2019 and later, Upgrade & Servicing Drivers', + 'Windows Server 2019', + 'Windows Server 2019', + 'Windows Server Drivers', + 'Windows Server Manager Windows Server Update Services (WSUS) Dynamic Installer', + 'Windows Server Solutions Best Practices Analyzer 1.0', + 'Windows Server Technical Preview Language Packs', + 'Windows Server, version 1903 and later') +} | Set-WsusProduct + +# Configure the Classifications +write-host 'Setting WSUS Classifications' +Get-WsusClassification | Where-Object { + $_.Classification.Title -in ( + 'Critical Updates', + 'Definition Updates', + 'Security Updates') +} | Set-WsusClassification + + + + + +# Prompt to check products are set correctly +write-host 'Before continuing, please open the WSUS Console, cancel the WSUS Configuration Wizard,' - -ForegroundColor Red +write-host 'Go to Options > Products and Classifications, and check that the Products are set correctly.' - -ForegroundColor Red +write-host 'Pausing script' -ForegroundColor Yellow +$Shell = New-Object -ComObject "WScript.Shell" +$Button = $Shell.Popup("Click OK to continue.", 0, "Script Paused", 0) # Using Pop-up in case script is running in ISE + + + + +# Configure Synchronizations +write-host 'Enabling WSUS Automatic Synchronisation' +$subscription.SynchronizeAutomatically=$true + +# Set synchronization scheduled for midnight each night +$subscription.SynchronizeAutomaticallyTimeOfDay= (New-TimeSpan -Hours 0) +$subscription.NumberOfSynchronizationsPerDay=1 +$subscription.Save() + +# Kick off a synchronization +$subscription.StartSynchronization() + + + +# Monitor Progress of Synchronisation + +write-host 'Starting WSUS Sync, will take some time' -ForegroundColor Magenta +Start-Sleep -Seconds 60 # Wait for sync to start before monitoring +while ($subscription.GetSynchronizationProgress().ProcessedItems -ne $subscription.GetSynchronizationProgress().TotalItems) { + Write-Progress -PercentComplete ( + $subscription.GetSynchronizationProgress().ProcessedItems*100/($subscription.GetSynchronizationProgress().TotalItems) + ) -Activity "WSUS Sync Progress" +} +Write-Host "Sync is done." -ForegroundColor Green + + +### DECLINE STUFF + + +#NEED TO try set-wsusproduct -disable + +# Configure Default Approval Rule + +if ($DefaultApproval -eq $True) +{ +write-host 'Configuring default automatic approval rule' +[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") +$rule = $wsus.GetInstallApprovalRules() | Where { + $_.Name -eq "Default Automatic Approval Rule"} +$class = $wsus.GetUpdateClassifications() | ? {$_.Title -In ( + 'Critical Updates', + 'Definition Updates', + 'Feature Packs', + 'Security Updates', + 'Service Packs', + 'Update Rollups', + 'Updates')} +$class_coll = New-Object Microsoft.UpdateServices.Administration.UpdateClassificationCollection +$class_coll.AddRange($class) +$rule.SetUpdateClassifications($class_coll) +$rule.Enabled = $True +$rule.Save() +} + + + diff --git a/ansible/roles/win_wsus/tasks/configure.yml b/ansible/roles/win_wsus/tasks/configure.yml index 2965122..8b9e7b2 100644 --- a/ansible/roles/win_wsus/tasks/configure.yml +++ b/ansible/roles/win_wsus/tasks/configure.yml @@ -2,16 +2,16 @@ - name: Configure WSUS server tags: configure_wsus block: - - name: Ensure Content directory exists - win_file: - path: "{{ wsus_content_directory }}" - state: directory + #- name: Ensure Content directory exists + # win_file: + # path: "{{ wsus_content_directory }}" + # state: directory - - name: Set WSUS Content Directory - tags: set_wsus_content_dir - win_shell: | - CD "C:\Program Files\Update Services\Tools" - .\wsusutil.exe postinstall CONTENT_DIR=W:\WSUS + #- name: Set WSUS Content Directory + # tags: set_wsus_content_dir + # win_shell: | + # CD "C:\Program Files\Update Services\Tools" + # .\wsusutil.exe postinstall CONTENT_DIR=W:\WSUS - name: WSUS Script tags: wsus_script @@ -19,13 +19,13 @@ - name: Copy WSUS script win_copy: src: "{{ wsus_script }}" - dest: "powershell {{ script_dir }}\\{{ wsus_script }}" + dest: "{{ script_dir }}\\{{ wsus_script }}" force: true tags: copy_wsus_script - - name: Apply WSUS script - win_shell: "powershell {{ script_dir }}\\{{ wsus_script }}" - tags: apply_wsus_script + #- name: Apply WSUS script + #win_shell: "powershell {{ script_dir }}\\{{ wsus_script }}" + #tags: apply_wsus_script