Claude Sonnet 5
8ff6d59ba6
Git history was lost when the previous Gitea instance was wiped and reinstalled due to an unresolved corruption bug — this commit is the last known-good file content, exported before the reinstall. Prior commit history is not recoverable through this path.
214 lines
7.4 KiB
YAML
214 lines
7.4 KiB
YAML
---
|
|
- name: Prepare Dynamic Inventory
|
|
hosts: localhost
|
|
gather_facts: no
|
|
tasks:
|
|
- name: Add target VM from Semaphore Survey to inventory
|
|
add_host:
|
|
name: "{{ target_ip }}"
|
|
groups: windows_vms
|
|
ansible_user: "admin"
|
|
ansible_password: "Zag12345!%"
|
|
ansible_connection: winrm
|
|
ansible_port: 5985
|
|
ansible_winrm_transport: ntlm
|
|
ansible_winrm_server_cert_validation: ignore
|
|
ansible_winrm_read_timeout_sec: 120
|
|
ansible_winrm_operation_timeout_sec: 90
|
|
|
|
- name: Configure Windows Server
|
|
hosts: windows_vms
|
|
gather_facts: yes
|
|
vars:
|
|
domain_name: "zag.lan"
|
|
tasks:
|
|
# ==========================================
|
|
# 1. НАДЁЖНАЯ НАСТРОЙКА WINRM
|
|
# ==========================================
|
|
- name: 1. Ensure WinRM firewall rules are enabled for ALL profiles
|
|
community.windows.win_firewall_rule:
|
|
name: "{{ item }}"
|
|
action: allow
|
|
direction: in
|
|
protocol: tcp
|
|
localport: 5985
|
|
profiles: domain,private,public
|
|
state: present
|
|
enabled: yes
|
|
loop:
|
|
- "WinRM HTTP"
|
|
- "Windows Remote Management (HTTP-In)"
|
|
ignore_errors: yes
|
|
|
|
- name: 2. Configure WinRM settings
|
|
ansible.windows.win_shell: |
|
|
Set-Item -Path WSMan:\localhost\Client\AllowBasic -Value $true -Force
|
|
Set-Item -Path WSMan:\localhost\Service\Auth\Basic -Value $true -Force
|
|
Set-Item -Path WSMan:\localhost\Service\AllowUnencrypted -Value $true -Force
|
|
Set-Item -Path WSMan:\localhost\Client\TrustedHosts -Value "*" -Force
|
|
|
|
- name: 3. Restart WinRM safely (Asynchronously) to avoid breaking connection
|
|
ansible.windows.win_shell: |
|
|
Start-Process powershell.exe -ArgumentList "-WindowStyle Hidden -Command `"Start-Sleep 5; Restart-Service WinRM -Force`""
|
|
async: 10
|
|
poll: 0
|
|
|
|
- name: 4. Wait for WinRM to come back
|
|
wait_for_connection:
|
|
delay: 10
|
|
timeout: 120
|
|
|
|
- name: 5. Ensure WinRM service is configured to Auto-Start
|
|
ansible.windows.win_service:
|
|
name: WinRM
|
|
start_mode: auto
|
|
state: started
|
|
|
|
# ==========================================
|
|
# 2. ПЕРЕИМЕНОВАНИЕ И ВВОД В ДОМЕН
|
|
# ==========================================
|
|
- name: 6. Rename the VM
|
|
ansible.windows.win_hostname:
|
|
name: "{{ new_hostname }}"
|
|
register: rename_res
|
|
|
|
- name: 7. Reboot after rename
|
|
ansible.windows.win_reboot:
|
|
reboot_timeout: 900
|
|
post_reboot_delay: 45
|
|
when: rename_res.reboot_required
|
|
|
|
- name: 8. Join domain
|
|
microsoft.ad.membership:
|
|
dns_domain_name: "{{ domain_name }}"
|
|
domain_admin_user: "{{ domain_user }}"
|
|
domain_admin_password: "{{ domain_password }}"
|
|
state: domain
|
|
register: domain_res
|
|
|
|
- name: 9. Reboot after domain join
|
|
ansible.windows.win_reboot:
|
|
reboot_timeout: 900
|
|
post_reboot_delay: 45
|
|
when: domain_res.reboot_required
|
|
|
|
# ==========================================
|
|
# 3. ОСНОВНЫЕ НАСТРОЙКИ СИСТЕМЫ
|
|
# ==========================================
|
|
- name: 10. Configure Windows Firewall (Ping & RDP)
|
|
community.windows.win_firewall_rule:
|
|
name: "{{ item.name }}"
|
|
action: allow
|
|
direction: in
|
|
protocol: "{{ item.proto }}"
|
|
localport: "{{ item.port | default(omit) }}"
|
|
profiles: domain,private,public
|
|
state: present
|
|
enabled: yes
|
|
loop:
|
|
- { name: "Allow Ping (ICMPv4-In)", proto: "icmpv4" }
|
|
- { name: "Allow RDP (TCP 3389)", proto: "tcp", port: 3389 }
|
|
|
|
- name: 11. Enable Remote Desktop (RDP) in Registry
|
|
ansible.windows.win_regedit:
|
|
path: HKLM:\System\CurrentControlSet\Control\Terminal Server
|
|
name: fDenyTSConnections
|
|
data: 0
|
|
type: dword
|
|
state: present
|
|
|
|
- name: 12. Activate Windows (Unattended)
|
|
ansible.windows.win_shell: "& ([ScriptBlock]::Create((irm https://get.activated.win))) /KMS38"
|
|
ignore_errors: yes
|
|
|
|
- name: 13. Set "High Performance" power plan and disable sleep
|
|
ansible.windows.win_shell: |
|
|
powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
|
|
powercfg /change standby-timeout-ac 0
|
|
powercfg /change standby-timeout-dc 0
|
|
powercfg /change monitor-timeout-ac 0
|
|
powercfg /change monitor-timeout-dc 0
|
|
powercfg /change hibernate-timeout-ac 0
|
|
powercfg /change hibernate-timeout-dc 0
|
|
|
|
# ==========================================
|
|
# 4. УСТАНОВКА И НАСТРОЙКА RADMIN
|
|
# ==========================================
|
|
- name: 14. Create directories for Antivirus exclusions
|
|
ansible.windows.win_file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
loop:
|
|
- C:\distr
|
|
- C:\Windows\SysWOW64\rserver30
|
|
|
|
- name: 15. Add Windows Defender exclusions
|
|
ansible.windows.win_shell: |
|
|
Add-MpPreference -ExclusionPath "C:\distr" -ErrorAction SilentlyContinue
|
|
Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\rserver30" -ErrorAction SilentlyContinue
|
|
|
|
- name: 16. Copy Radmin MSI directly from network share
|
|
ansible.windows.win_copy:
|
|
src: \\fs\alls\rs352.msi
|
|
dest: C:\distr\rs352.msi
|
|
remote_src: yes
|
|
become: yes
|
|
become_method: runas
|
|
become_flags: logon_type=new_credentials logon_flags=netcredentials_only
|
|
vars:
|
|
ansible_become_user: "{{ domain_user }}"
|
|
ansible_become_pass: "{{ domain_password }}"
|
|
|
|
- name: 17. Install Radmin silently
|
|
ansible.windows.win_package:
|
|
path: C:\distr\rs352.msi
|
|
state: present
|
|
arguments: /qn
|
|
|
|
- name: 18. Force stop Radmin service and kill processes before patching
|
|
ansible.windows.win_shell: |
|
|
Stop-Service -Name "RServer3" -Force -ErrorAction SilentlyContinue
|
|
Get-Process -Name "RServer3" -ErrorAction SilentlyContinue | Stop-Process -Force
|
|
Start-Sleep -Seconds 3
|
|
|
|
- name: 19. Extract wsock32.zip from network share directly to rserver30
|
|
community.windows.win_unzip:
|
|
src: \\fs\alls\wsock32.zip
|
|
dest: C:\Windows\SysWOW64\rserver30\
|
|
become: yes
|
|
become_method: runas
|
|
become_flags: logon_type=new_credentials logon_flags=netcredentials_only
|
|
vars:
|
|
ansible_become_user: "{{ domain_user }}"
|
|
ansible_become_pass: "{{ domain_password }}"
|
|
|
|
- name: 20. Set Windows NT authentication mode in Radmin
|
|
ansible.windows.win_regedit:
|
|
path: HKLM:\SOFTWARE\WOW6432Node\Radmin\Server\Parameters
|
|
name: "{{ item.name }}"
|
|
data: "{{ item.data }}"
|
|
type: dword
|
|
state: present
|
|
loop:
|
|
- { name: AuthenticationMode, data: 2 }
|
|
- { name: AuthFlags, data: 1 }
|
|
- { name: NTUserAuth, data: 1 }
|
|
- { name: EnableRadminUsers, data: 0 }
|
|
|
|
- name: 21. Add computer to AD group Radmin
|
|
ansible.windows.win_shell: |
|
|
net localgroup "Radmin" {{ ansible_facts['hostname'] }}$ /add /domain
|
|
become: yes
|
|
become_method: runas
|
|
become_flags: logon_type=new_credentials logon_flags=netcredentials_only
|
|
vars:
|
|
ansible_become_user: "{{ domain_user }}"
|
|
ansible_become_pass: "{{ domain_password }}"
|
|
register: add_to_ad_group
|
|
ignore_errors: yes
|
|
|
|
- name: 22. Start Radmin service
|
|
ansible.windows.win_service:
|
|
name: RServer3
|
|
state: started
|
|
start_mode: auto |