windows-ansible/ansible/roles/win_domain_controller/tasks/dc-logon.yml

---
- name: Set Reg Keys
  tags:
    - logon
  block:
    - name: Configure Windows Logon Script via GPO
      tasks:
        #- name: Ensure script file is present in shared directory
        # ansible.windows.win_copy:
        #   src: /path/to/logon.ps1
        #   dest: "C:\\eidf\\logon.ps1"
        #   remote_src: false

        - name: Create a new Group Policy Object (GPO)
          ansible.windows.win_shell:
            command: |
              Import-Module GroupPolicy
              if (!(Get-GPO -Name "User Logon Script" -ErrorAction SilentlyContinue)) {
                  New-GPO -Name "User Logon Script" -Domain "yourdomain.local"
              }
          ignore_errors: true

        - name: Link GPO to Organizational Unit (OU)
          ansible.windows.win_shell:
            command: |
              Import-Module GroupPolicy
              if (!(Get-GPLink -Name "User Logon Script" -Target "OU=YourOU,DC=yourdomain,DC=local" -ErrorAction SilentlyContinue)) {
                  New-GPLink -Name "User Logon Script" -Target "OU=YourOU,DC=yourdomain,DC=local"
              }

        - name: Configure the logon script in GPO
          ansible.windows.win_shell:
            command: |
              Import-Module GroupPolicy
              Set-GPRegistryValue -Name "User Logon Script" -Key "HKCU\Environment" -ValueName "LogonScript" -Type String -Value "C:\\eidf\\logon.ps1"

        - name: Allow PowerShell scripts to execute
          ansible.windows.win_shell:
            command: |
              Import-Module GroupPolicy
              Set-GPRegistryValue -Name "User Logon Script" -Key "HKLM\Software\Policies\Microsoft\Windows\PowerShell" -ValueName "ExecutionPolicy" -Type String -Value "Unrestricted"

        - name: Force Group Policy update on clients
          ansible.windows.win_command:
            command: gpupdate /Force