remote desktop (currently not active)

ansible/roles/win_domain_controller/tasks/main.yml

@@ -2,3 +2,4 @@
 - import_tasks: features.yml
 - import_tasks: setup.yml
 - import_tasks: users.yml
+- import_tasks: remote_desktop.yml

ansible/roles/win_domain_controller/tasks/remote_desktop.yml

@@ -0,0 +1,150 @@
+---
+- name: Remote Desktop Gateway
+  # RD gateway not enabled on Domain Controller???
+  tags: 
+    - rd_gateway
+    - never
+  block:
+    - name: Create directory structure
+      win_file:
+        path: C:\Certs
+        state: directory
+      when: inventory_hostname in groups['meta-name_dc01']
+
+    - name: Firewall rule to allow HTTPS on TCP port 443
+      community.windows.win_firewall_rule:
+        name: Remote Desktop Gateway
+        localport: 443
+        action: allow
+        direction: in
+        protocol: tcp
+        profiles: [domain, private, public]
+        state: present
+        enabled: true
+      when: inventory_hostname in groups['meta-name_dc01']
+
+    - name: Configure the Remote Desktop Gateway
+      community.windows.win_rds_settings:
+        max_connections: 10
+      when: inventory_hostname in groups['meta-name_dc01']
+
+    - name: Create a new RDS CAP with a 30 minutes timeout and clipboard redirection enabled
+      community.windows.win_rds_cap:
+        name: Remote Gateway CAP
+        user_groups:
+          - BUILTIN\Users
+        session_timeout: 120
+        session_timeout_action: disconnect
+        allow_only_sdrts_servers: true
+        redirect_clipboard: true
+        redirect_drives: false
+        redirect_printers: false
+        redirect_serial: false
+        redirect_pnp: false
+        state: enabled
+      when: inventory_hostname in groups['meta-name_dc01']
+
+    - name: Create a new RDS RAP
+      community.windows.win_rds_rap:
+        name: Remote Gateway RAP
+        description: Allow all users to connect to any resource through ports 3389
+        user_groups:
+          - BUILTIN\Users
+        computer_group_type: allow_any
+        allowed_ports:
+          - 3389
+        state: enabled
+      when: inventory_hostname in groups['meta-name_dc01']
+
+      - name: Reboot the machine to complete
+      ansible.windows.win_reboot:
+      when: inventory_hostname in groups['meta-name_dc01']
+
+#------------------------------------------------rd_licensing
+
+- name: Remote Desktop Licensing
+  tags: 
+    - rd_licensing
+    - never
+  block: 
+    - name: Add RDS server to Terminal Server Licensing Servers AD group
+      win_domain_group_membership:
+        domain_server: "{{ win_project }}.loc"
+        name: Terminal Server License Servers
+        members:
+          - "{{ win_project }}-dc01$" # $ ????
+        state: present
+      when: inventory_hostname in groups['meta-name_dc01']
+
+    - name: Add 'Network Service' system account to Terminal Server Licensing Servers AD group
+      win_powershell:
+        script: |
+          net localgroup "Terminal Server License Servers" /Add 'Network Service'
+      #args:
+      #  executable: powershell.exe
+      when: inventory_hostname in groups['meta-name_dc01']
+
+    - name: Restart the Remote Desktop Licensing service
+      win_service:
+        name: Remote Desktop Licensing
+        state: restarted
+      when: inventory_hostname in groups['meta-name_dc01']
+
+    # needed ??????
+    - name: Refresh of facts must happen here.
+      setup:
+
+    - name: Activate Remote Desktop Licensing server
+      win_powershell:
+        script: |
+            function log-info($data)
+            {
+              #$data = "$([DateTime]::Now):$($data)"
+              write-host ($data | out-string)
+            }
+            function main()
+            {
+              $licenseServer='localhost'
+              $companyInformation = @{}
+              $companyInformation.FirstName="Suzy"
+              $companyInformation.LastName="Sample"
+              $companyInformation.Company="Independent Consolidators"
+              $companyInformation.CountryRegion="United States"
+              activate-licenseServer $licenseServer $companyInformation
+            }
+            function activate-licenseServer($licServer, $companyInfo)
+            {
+              $licServerResult = @{}
+              $licServerResult.LicenseServerActivated = $Null
+              $wmiClass = ([wmiclass]"\\$($licServer)\root\cimv2:Win32_TSLicenseServer")
+              $wmiTSLicenseObject = Get-WMIObject Win32_TSLicenseServer -computername $licServer
+              $wmiTSLicenseObject.FirstName=$companyInfo.FirstName
+              $wmiTSLicenseObject.LastName=$companyInfo.LastName
+              $wmiTSLicenseObject.Company=$companyInfo.Company
+              $wmiTSLicenseObject.CountryRegion=$companyInfo.CountryRegion
+              $wmiTSLicenseObject.Put()
+              $wmiClass.ActivateServerAutomatic()
+              $licServerResult.LicenseServerActivated = $wmiClass.GetActivationStatus().ActivationStatus
+              log-info "activation status: $($licServerResult.LicenseServerActivated) (0 = activated, 1 = not activated)"
+            }
+            function deactivate-licenseServer($licServer)
+            {
+              $wmiClass = ([wmiclass]"\\$($licServer)\root\cimv2:Win32_TSLicenseServer")
+              $wmiClass.DeactivateServerAutomatic()
+            }
+            main
+        parameters:
+          ProjectName: "{{ win_project }}"
+      when: inventory_hostname in groups['meta-name_dc01']
+
+    - name: Install RDS CALs using PowerShell
+      ansible.windows.win_powershell:
+        script: |
+          # Replace 'our_license_key' with your actual RDS CAL license key
+          $licenseKey = '49050116'
+          $obj = New-Object -ComObject 'RDMS.RDLicenseKey'
+          $obj.Import($licenseKey, 'perUser')
+          $obj.RegisterServer('whatever_we_call_the_RDS_Server')
+      args:
+        executable: powershell.exe
+      when: inventory_hostname in groups['meta-name_dc01']