windows-ansible/ansible/roles/win_domain_controller/tasks/setup.yml

---
- name: Promote DC01
  tags: promote_dc01
  any_errors_fatal: true
  block:
    - name: Promote DC01 to domain controller
      microsoft.ad.domain:
        dns_domain_name: "{{ win_project }}.loc"
        safe_mode_password: "{{ safemode_password }}"
        domain_netbios_name: "{{ win_project|upper }}"
      register: dc01_promotion

    - name: Setting DNS Servers (Primary DC)
      vars:
        dc02_dns: "{{ os_project }}-{{ win_project }}-dc02"
      win_dns_client:
        adapter_names: "*"
        dns_servers:
          - "127.0.0.1"
          - "{{ hostvars[dc02_dns].ansible_host }}"

    - name: Copy ADMX/ADML files
      tags: copy_admx
      block:
        - name: Copy ADMX and ADML files to DCs
          win_copy:
            src: policy_templates/PolicyDefinitions
            dest: "{{ policy_path }}\\"
            force: true

    - name: Rebooting DC01 post promotion to domain controller
      win_reboot:
        reboot_timeout_sec: 1200
      when: dc01_promotion.reboot_required | default(false) == true
  when: inventory_hostname in groups['meta-name_dc01']

- name: Promote DC02
  tags: promote_dc02
  block:
    - name: Setting DNS Servers (Secondary DC)
      vars:
        dc01_dns: "{{ os_project }}-{{ win_project }}-dc01"
      win_dns_client:
        adapter_names: "*"
        dns_servers:
          - "{{ hostvars[dc01_dns].ansible_host }}"
          - "127.0.0.1"

    - name: wait for 30 seconds for DNS
      pause:
        seconds: 30

    - name: flush DNS cache
      win_shell: ipconfig /flushdns

    - name: Promote DC02 to domain controller
      microsoft.ad.domain_controller:
        dns_domain_name: "{{ win_project }}.loc"
        domain_admin_user: "Administrator@{{ win_project }}.loc"
        domain_admin_password: "{{ ansible_password }}"
        safe_mode_password: "{{ safemode_password }}"
        state: domain_controller
      register: dc02_promotion

  rescue: 
    - name: Wait 2 minutes before trying to promote again
      pause:
        minutes: 2

    - name: Promote DC02 to domain controller
      microsoft.ad.domain_controller:
        dns_domain_name: "{{ win_project }}.loc"
        domain_admin_user: "Administrator@{{ win_project }}.loc"
        domain_admin_password: "{{ ansible_password }}"
        safe_mode_password: "{{ safemode_password }}"
        state: domain_controller
      register: dc02_promotion

  always: 
    - name: Setting DNS Servers (Secondary DC)
      vars:
        dc01_dns: "{{ os_project }}-{{ win_project }}-dc01"
      win_dns_client:
        adapter_names: "*"
        dns_servers:
          - "127.0.0.1"
          - "{{ hostvars[dc01_dns].ansible_host }}"
          
    - name: Rebooting DC02 post promotion to domain controller
      win_reboot:
        reboot_timeout_sec: 1200
      when: dc02_promotion.reboot_required | default(false) == true
  when: inventory_hostname in groups['meta-name_dc02']


- name: Create Required OUs and Users 
  tags:
    - promote_dc01 
    - post_promotion_tasks
  block:
    - name: Create various OUs
      microsoft.ad.ou:
        name: "{{ item }}"
        path: "DC={{ win_project }},DC=loc"
        state: present
        protect_from_deletion: true
      loop: "{{ OUs }}"

    - name: Create file-transfer user
      microsoft.ad.user:
        name: "{{ filetransfer_user }}"
        firstname: File
        surname: Transfer
        password: "{{ transfer_user_password }}"
        state: present
        password_never_expires: yes
        
    - name: Create file-manager user
      microsoft.ad.user:
        name: "{{ filemanager_user }}"
        firstname: File
        surname: Manager
        password: "{{ file_manager_password }}"
        state: present
        password_never_expires: yes
      
    - name: Create Guacamole Users group for RDP access
      microsoft.ad.group:
        name: "{{ guacamole_user_group }}"
        description: "Allow remote logon for guacamole users"
        path: "cn=Users,dc={{ win_project }},dc=loc"
        scope: domainlocal
        category: security
  when: inventory_hostname in groups['meta-name_dc01']


- name: Group policy script
  tags: gpo_script
  block:
    - name: Copy Group Policy script to DC01
      win_copy:
        src: "{{ group_policy_script }}"
        dest: "C:\\eidf"
        force: true
      tags: copy_gpo_script

    - name: Apply group policy
      win_shell: powershell C:\eidf\{{ group_policy_script }}
      tags: apply_gpo_script
  when: inventory_hostname in groups['meta-name_dc01']

- name: Server Hardening script
  tags: hardening_script
  block:
    - name: Copy Server Hardening script to DC01
      win_copy:
        src: "{{ server_hardening_script }}"
        dest: "C:\\eidf"
        force: true
      tags: copy_hardening_script

    - name: Apply server hardening
      win_shell: powershell C:\eidf\{{ server_hardening_script }}
      tags: apply_hardening_scripts
  when: inventory_hostname in groups['meta-name_dc01']

- name: Squid Proxy GPO Script
  tags: proxy_script
  block:
    - name: Copy Squid GPO Script
      vars:
        proxy_vm: "{{ os_project }}-{{ win_project }}-proxy"
        proxy_address: "{{ hostvars[proxy_vm].ansible_host }}:3128"
      ansible.windows.win_template:
        src: "{{ squid_proxy_script_tmpl }}"
        dest: "{{ script_dir }}\\{{ squid_proxy_script }}"
        force: true
      tags: copy_proxy_script

    - name: Apply Squid GPO Script
      win_shell: "powershell {{ script_dir }}\\{{ squid_proxy_script }}"
      tags: create_proxy_gpo
  when: |
    inventory_hostname in groups['meta-name_dc01'] and
    project_zone == 'protected'

- name: Mapped Drive GPO Script
  tags: mapped_drive_script
  block:
    - name: Copy Mapped Drive GPO Script
      ansible.windows.win_template:
        src: "{{ mapped_drive_script_tmpl }}"
        dest: "{{ script_dir }}\\{{ mapped_drive_script }}"
        force: true
      tags: copy_mapped_drive_script

    - name: Apply Mapped Drive GPO Script
      win_shell: "powershell {{ script_dir }}\\{{ mapped_drive_script }}"
      tags: create_mapped_drive_gpo
  when: inventory_hostname in groups['meta-name_dc01']