---
- name: Password
  tags: 
    - password
    - password_check
    - always
  block:
    - name: Check for pending password status
      set_fact:
        ansible_password: "{{ vm_initial_password }}"
      run_once: true
      when: password_status == 'pending' 

    - name: Check for finished or change password status
      set_fact:
        ansible_password: "{{ vm_password }}"
      run_once: true
      when: password_status == 'finished' or
            password_status == 'change'
    
    - name: Test password
      win_ping:
      tags: initial_ping

- name: Ping Windows hosts
  win_ping:
  tags: initial_ping

- name: Set WinRM to delayed startup
  ansible.windows.win_service:
    name: WinRM
    start_mode: delayed
  tags: winrm_delayed

- name: Remove Local Admin
  tags: remove_admin
  block:
    - name: Delete admin user account
      win_user:
        name: Admin
        state: absent

    - name: Delete Admin Home folder
      win_file:
        path: "C:\\Users\\Admin"
        state: absent 
  rescue:
    - name: Reboot VMs
      win_reboot:

    - name: Try again to delete Admin Home folder
      win_file:
        path: "C:\\Users\\Admin"
        state: absent

- name: Reboot VMs
  win_reboot:
  tags: reboot

- name: Create EIDF directory in system drive
  win_file:
    path: "C:\\eidf"
    state: directory
  tags: eidf_dir_create

- name: Veeam account creation 
  win_user:    
    name: VeeamUser
    description: Veeam Backup account
    password: "{{ veeam_password }}"
    password_never_expires: True
    state: present
    groups:
      - Administrators
  tags: 
    - veeam_account

- name: Set timezone
  community.windows.win_timezone:
    timezone: GMT Standard Time
  tags: timezone

- name: Activation
  tags:
    - never 
    - activate_windows
  block: 
    - name: Fix evaluation edition
      ansible.windows.win_shell: DISM /online /Set-Edition:ServerStandard /ProductKey:{{ product_key }} /AcceptEula /Quiet
      ignore_errors: true
      retries: 2

    - name: Activate Windows
      ansible.windows.win_powershell:
        script: |
          invoke-command -computername {{ win_project }}-{{ inventory_hostname.split('-')[-1] }} -scriptblock { slmgr //b /upk ; slmgr //b /cpky ; slmgr //b /ipk {{ product_key }} ; slmgr //b /ato}

- name: Administrator Password
  tags:
    - password
    - password_change
    - always
  block: 
    - name: Change Administrator password
      win_user:
        name: Administrator
        password: "{{ vm_password }}"

    - name: Set Password Status
      vars:
        ansible_connection: local
      replace:
        path: /deployments/{{ os_project }}-{{ win_project }}/PASSWORD
        regexp: '^{{ password_status }}$'
        replace: 'finished'
      delegate_to: localhost
      run_once: True
  when: password_status == 'pending' or 
        password_status == 'change'