windows-ansible/ansible/roles/win_domain_controller/tasks/remote_desktop.yml

---
- name: Remote Desktop Gateway
  # RD gateway not enabled on Domain Controller???
  tags: 
    - rd_gateway
  block:
    - name: Create directory structure
      win_file:
        path: C:\Certs
        state: directory
      when: inventory_hostname in groups['meta-name_dc01']

    - name: Firewall rule to allow HTTPS on TCP port 443
      community.windows.win_firewall_rule:
        name: Remote Desktop Gateway
        localport: 443
        action: allow
        direction: in
        protocol: tcp
        profiles: [domain, private, public]
        state: present
        enabled: true
      when: inventory_hostname in groups['meta-name_dc01']

    - name: Configure the Remote Desktop Gateway
      community.windows.win_rds_settings:
        max_connections: 10
      when: inventory_hostname in groups['meta-name_dc01']

    - name: Create a new RDS CAP with a 30 minutes timeout and clipboard redirection enabled
      community.windows.win_rds_cap:
        name: Remote Gateway CAP
        user_groups:
          - BUILTIN\Users
        session_timeout: 120
        session_timeout_action: disconnect
        allow_only_sdrts_servers: true
        redirect_clipboard: true
        redirect_drives: false
        redirect_printers: false
        redirect_serial: false
        redirect_pnp: false
        state: enabled
      when: inventory_hostname in groups['meta-name_dc01']

    - name: Create a new RDS RAP
      community.windows.win_rds_rap:
        name: Remote Gateway RAP
        description: Allow all users to connect to any resource through ports 3389
        user_groups:
          - BUILTIN\Users
        computer_group_type: allow_any
        allowed_ports:
          - 3389
        state: enabled
      when: inventory_hostname in groups['meta-name_dc01']

    - name: Reboot the machine to complete
      ansible.windows.win_reboot:
      when: inventory_hostname in groups['meta-name_dc01']

#------------------------------------------------rd_licensing

- name: Remote Desktop Licensing
  tags: 
    - rd_licensing
  block: 
    - name: Add RDS server to Terminal Server Licensing Servers AD group
      win_domain_group_membership:
        domain_server: "{{ win_project }}.loc"
        name: Terminal Server License Servers
        members:
          # $ at end needed for computers
          - "{{ win_project }}-dc01$"
        state: present
      when: inventory_hostname in groups['meta-name_dc01']

    - name: Add 'Network Service' system account to Terminal Server Licensing Servers AD group
      win_powershell:
        script: |
          net localgroup "Terminal Server License Servers" /Add 'Network Service'
      when: inventory_hostname in groups['meta-name_dc01']

    - name: Restart the Remote Desktop Licensing service
      win_service:
        name: Remote Desktop Licensing
        state: restarted
      when: inventory_hostname in groups['meta-name_dc01']

    # needed ??????
    - name: Refresh of facts must happen here.
      setup:

    - name: Activate Remote Desktop Licensing server
      win_powershell:
        script: |
            function log-info($data)
            {
              #$data = "$([DateTime]::Now):$($data)"
              write-host ($data | out-string)
            }
            function main()
            {
              $licenseServer='localhost'
              $companyInformation = @{}
              $companyInformation.FirstName="Suzy"
              $companyInformation.LastName="Sample"
              $companyInformation.Company="Independent Consolidators"
              $companyInformation.CountryRegion="United States"
              activate-licenseServer $licenseServer $companyInformation
            }
            function activate-licenseServer($licServer, $companyInfo)
            {
              $licServerResult = @{}
              $licServerResult.LicenseServerActivated = $Null
              $wmiClass = ([wmiclass]"\\$($licServer)\root\cimv2:Win32_TSLicenseServer")
              $wmiTSLicenseObject = Get-WMIObject Win32_TSLicenseServer -computername $licServer
              $wmiTSLicenseObject.FirstName=$companyInfo.FirstName
              $wmiTSLicenseObject.LastName=$companyInfo.LastName
              $wmiTSLicenseObject.Company=$companyInfo.Company
              $wmiTSLicenseObject.CountryRegion=$companyInfo.CountryRegion
              $wmiTSLicenseObject.Put()
              $wmiClass.ActivateServerAutomatic()
              $licServerResult.LicenseServerActivated = $wmiClass.GetActivationStatus().ActivationStatus
              log-info "activation status: $($licServerResult.LicenseServerActivated) (0 = activated, 1 = not activated)"
            }
            function deactivate-licenseServer($licServer)
            {
              $wmiClass = ([wmiclass]"\\$($licServer)\root\cimv2:Win32_TSLicenseServer")
              $wmiClass.DeactivateServerAutomatic()
            }
            main
        parameters:
          # Unused???
          ProjectName: "{{ win_project }}"
      when: inventory_hostname in groups['meta-name_dc01']

    - name: Install RDS CALs using PowerShell
      ansible.windows.win_powershell:
        script: |
          # Replace 'our_license_key' with your actual RDS CAL license key
          $licenseKey = '49050116'
          $obj = New-Object -ComObject 'RDMS.RDLicenseKey'
          $obj.Import($licenseKey, 'perUser')
          $obj.RegisterServer('whatever_we_call_the_RDS_Server')
      when: inventory_hostname in groups['meta-name_dc01']