From f493bdbae639f72c3c6389b2522ae61d1feb7f25 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 9 Apr 2024 11:35:34 +0000 Subject: [PATCH] remote desktop (currently not active) --- .../win_domain_controller/tasks/main.yml | 1 + .../tasks/remote_desktop.yml | 150 ++++++++++++++++++ 2 files changed, 151 insertions(+) create mode 100644 ansible/roles/win_domain_controller/tasks/remote_desktop.yml diff --git a/ansible/roles/win_domain_controller/tasks/main.yml b/ansible/roles/win_domain_controller/tasks/main.yml index 3fbe0a3..5d187bc 100644 --- a/ansible/roles/win_domain_controller/tasks/main.yml +++ b/ansible/roles/win_domain_controller/tasks/main.yml @@ -2,3 +2,4 @@ - import_tasks: features.yml - import_tasks: setup.yml - import_tasks: users.yml +- import_tasks: remote_desktop.yml diff --git a/ansible/roles/win_domain_controller/tasks/remote_desktop.yml b/ansible/roles/win_domain_controller/tasks/remote_desktop.yml new file mode 100644 index 0000000..e43444f --- /dev/null +++ b/ansible/roles/win_domain_controller/tasks/remote_desktop.yml @@ -0,0 +1,150 @@ +--- +- name: Remote Desktop Gateway + # RD gateway not enabled on Domain Controller??? + tags: + - rd_gateway + - never + block: + - name: Create directory structure + win_file: + path: C:\Certs + state: directory + when: inventory_hostname in groups['meta-name_dc01'] + + - name: Firewall rule to allow HTTPS on TCP port 443 + community.windows.win_firewall_rule: + name: Remote Desktop Gateway + localport: 443 + action: allow + direction: in + protocol: tcp + profiles: [domain, private, public] + state: present + enabled: true + when: inventory_hostname in groups['meta-name_dc01'] + + - name: Configure the Remote Desktop Gateway + community.windows.win_rds_settings: + max_connections: 10 + when: inventory_hostname in groups['meta-name_dc01'] + + - name: Create a new RDS CAP with a 30 minutes timeout and clipboard redirection enabled + community.windows.win_rds_cap: + name: Remote Gateway CAP + user_groups: + - BUILTIN\Users + session_timeout: 120 + session_timeout_action: disconnect + allow_only_sdrts_servers: true + redirect_clipboard: true + redirect_drives: false + redirect_printers: false + redirect_serial: false + redirect_pnp: false + state: enabled + when: inventory_hostname in groups['meta-name_dc01'] + + - name: Create a new RDS RAP + community.windows.win_rds_rap: + name: Remote Gateway RAP + description: Allow all users to connect to any resource through ports 3389 + user_groups: + - BUILTIN\Users + computer_group_type: allow_any + allowed_ports: + - 3389 + state: enabled + when: inventory_hostname in groups['meta-name_dc01'] + + - name: Reboot the machine to complete + ansible.windows.win_reboot: + when: inventory_hostname in groups['meta-name_dc01'] + +#------------------------------------------------rd_licensing + +- name: Remote Desktop Licensing + tags: + - rd_licensing + - never + block: + - name: Add RDS server to Terminal Server Licensing Servers AD group + win_domain_group_membership: + domain_server: "{{ win_project }}.loc" + name: Terminal Server License Servers + members: + - "{{ win_project }}-dc01$" # $ ???? + state: present + when: inventory_hostname in groups['meta-name_dc01'] + + - name: Add 'Network Service' system account to Terminal Server Licensing Servers AD group + win_powershell: + script: | + net localgroup "Terminal Server License Servers" /Add 'Network Service' + #args: + # executable: powershell.exe + when: inventory_hostname in groups['meta-name_dc01'] + + - name: Restart the Remote Desktop Licensing service + win_service: + name: Remote Desktop Licensing + state: restarted + when: inventory_hostname in groups['meta-name_dc01'] + + # needed ?????? + - name: Refresh of facts must happen here. + setup: + + - name: Activate Remote Desktop Licensing server + win_powershell: + script: | + function log-info($data) + { + #$data = "$([DateTime]::Now):$($data)" + write-host ($data | out-string) + } + function main() + { + $licenseServer='localhost' + $companyInformation = @{} + $companyInformation.FirstName="Suzy" + $companyInformation.LastName="Sample" + $companyInformation.Company="Independent Consolidators" + $companyInformation.CountryRegion="United States" + activate-licenseServer $licenseServer $companyInformation + } + function activate-licenseServer($licServer, $companyInfo) + { + $licServerResult = @{} + $licServerResult.LicenseServerActivated = $Null + $wmiClass = ([wmiclass]"\\$($licServer)\root\cimv2:Win32_TSLicenseServer") + $wmiTSLicenseObject = Get-WMIObject Win32_TSLicenseServer -computername $licServer + $wmiTSLicenseObject.FirstName=$companyInfo.FirstName + $wmiTSLicenseObject.LastName=$companyInfo.LastName + $wmiTSLicenseObject.Company=$companyInfo.Company + $wmiTSLicenseObject.CountryRegion=$companyInfo.CountryRegion + $wmiTSLicenseObject.Put() + $wmiClass.ActivateServerAutomatic() + $licServerResult.LicenseServerActivated = $wmiClass.GetActivationStatus().ActivationStatus + log-info "activation status: $($licServerResult.LicenseServerActivated) (0 = activated, 1 = not activated)" + } + function deactivate-licenseServer($licServer) + { + $wmiClass = ([wmiclass]"\\$($licServer)\root\cimv2:Win32_TSLicenseServer") + $wmiClass.DeactivateServerAutomatic() + } + main + parameters: + ProjectName: "{{ win_project }}" + when: inventory_hostname in groups['meta-name_dc01'] + + - name: Install RDS CALs using PowerShell + ansible.windows.win_powershell: + script: | + # Replace 'our_license_key' with your actual RDS CAL license key + $licenseKey = '49050116' + $obj = New-Object -ComObject 'RDMS.RDLicenseKey' + $obj.Import($licenseKey, 'perUser') + $obj.RegisterServer('whatever_we_call_the_RDS_Server') + args: + executable: powershell.exe + when: inventory_hostname in groups['meta-name_dc01'] \ No newline at end of file