From fa7e4aa7616d8dda7bf0123a70715049c51bf910 Mon Sep 17 00:00:00 2001
From: cfinlay <c.finlay@epcc.ed.ac.uk>
Date: Wed, 22 Jan 2025 14:18:26 +0000
Subject: [PATCH] Setup login script task

---
 .../win_domain_controller/tasks/dc-logon.yml  | 45 +++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 ansible/roles/win_domain_controller/tasks/dc-logon.yml

diff --git a/ansible/roles/win_domain_controller/tasks/dc-logon.yml b/ansible/roles/win_domain_controller/tasks/dc-logon.yml
new file mode 100644
index 0000000..1849b9c
--- /dev/null
+++ b/ansible/roles/win_domain_controller/tasks/dc-logon.yml
@@ -0,0 +1,45 @@
+---
+- name: Set Reg Keys
+  tags:
+    - logon
+  block:
+    - name: Configure Windows Logon Script via GPO
+      tasks:
+        #- name: Ensure script file is present in shared directory
+        # ansible.windows.win_copy:
+        #   src: /path/to/logon.ps1
+        #   dest: "C:\\eidf\\logon.ps1"
+        #   remote_src: false
+
+        - name: Create a new Group Policy Object (GPO)
+          ansible.windows.win_shell:
+            command: |
+              Import-Module GroupPolicy
+              if (!(Get-GPO -Name "User Logon Script" -ErrorAction SilentlyContinue)) {
+                  New-GPO -Name "User Logon Script" -Domain "yourdomain.local"
+              }
+          ignore_errors: true
+
+        - name: Link GPO to Organizational Unit (OU)
+          ansible.windows.win_shell:
+            command: |
+              Import-Module GroupPolicy
+              if (!(Get-GPLink -Name "User Logon Script" -Target "OU=YourOU,DC=yourdomain,DC=local" -ErrorAction SilentlyContinue)) {
+                  New-GPLink -Name "User Logon Script" -Target "OU=YourOU,DC=yourdomain,DC=local"
+              }
+
+        - name: Configure the logon script in GPO
+          ansible.windows.win_shell:
+            command: |
+              Import-Module GroupPolicy
+              Set-GPRegistryValue -Name "User Logon Script" -Key "HKCU\Environment" -ValueName "LogonScript" -Type String -Value "C:\\eidf\\logon.ps1"
+
+        - name: Allow PowerShell scripts to execute
+          ansible.windows.win_shell:
+            command: |
+              Import-Module GroupPolicy
+              Set-GPRegistryValue -Name "User Logon Script" -Key "HKLM\Software\Policies\Microsoft\Windows\PowerShell" -ValueName "ExecutionPolicy" -Type String -Value "Unrestricted"
+
+        - name: Force Group Policy update on clients
+          ansible.windows.win_command:
+            command: gpupdate /Force