---
- name: Add Guacamole group to remote desktop users
  ansible.windows.win_group_membership:
    name: Remote Desktop Users
    members:
      - "{{ win_project}}\\{{ guacamole_user_group }}"
    state: present
  tags: guacamole_rdu

- name: RD Gateway setup
  tags: client_rdgw
  block:
    - name: Local policy for 'Remote Desktop Users' group to log on through Remote Desktop Services
      ansible.windows.win_user_right:
        name: SeRemoteInteractiveLogonRight
        users:
          - Remote Desktop Users
        action: add

    # https://exchangepedia.com/2016/10/enable-remote-desktop-rdp-connections-for-admins-on-windows-server-2016.html
    - name: Registry edit - fDenyTSConnections
      ansible.windows.win_dsc:
        resource_name: Registry
        Ensure: Present
        Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
        ValueName: fDenyTSConnections
        ValueData: 0
        PsDscRunAsCredential_username: Administrator
        PsDscRunAsCredential_password: "{{ ansible_password }}"

    - name: Registry edit - fSingleSessionPerUser
      ansible.windows.win_dsc:
        resource_name: Registry
        Ensure: Present
        Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
        ValueName: fSingleSessionPerUser
        ValueData: 1
        PsDscRunAsCredential_username: Administrator
        PsDscRunAsCredential_password: "{{ ansible_password }}"

    - name: Registry edit - SecurityLayer
      ansible.windows.win_dsc:
        resource_name: Registry
        Ensure: Present
        Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
        ValueName: SecurityLayer
        ValueData: 0
        PsDscRunAsCredential_username: Administrator
        PsDscRunAsCredential_password: "{{ ansible_password }}"

    - name: Registry edit - UserAuthentication
      ansible.windows.win_dsc:
        resource_name: Registry
        Ensure: Present
        Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
        ValueName: UserAuthentication
        ValueData: 0
        PsDscRunAsCredential_username: Administrator
        PsDscRunAsCredential_password: "{{ ansible_password }}"

    - name: Enable NetFireWallRule -  “Remote Desktop”
      tags: temp
      ansible.windows.win_powershell:
        script: |
          Enable-NetFirewallRule -DisplayGroup “Remote Desktop”