Claude Sonnet 5
8ff6d59ba6
Git history was lost when the previous Gitea instance was wiped and reinstalled due to an unresolved corruption bug — this commit is the last known-good file content, exported before the reinstall. Prior commit history is not recoverable through this path.
105 lines
3.4 KiB
YAML
105 lines
3.4 KiB
YAML
---
|
|
- name: Prepare Dynamic Inventory
|
|
hosts: localhost
|
|
gather_facts: no
|
|
tasks:
|
|
- name: Add target VM from Semaphore Survey to inventory
|
|
add_host:
|
|
name: "{{ target_ip }}"
|
|
groups: windows_vms
|
|
# Креды локального админа для подключения к свежей ВМ
|
|
ansible_user: "Администратор"
|
|
ansible_password: "Zag12345!%"
|
|
ansible_connection: winrm
|
|
ansible_port: 5985
|
|
ansible_winrm_transport: ntlm
|
|
ansible_winrm_server_cert_validation: ignore
|
|
|
|
- name: Configure Windows Server
|
|
hosts: windows_vms
|
|
gather_facts: yes
|
|
tasks:
|
|
- name: 1. Rename the VM
|
|
ansible.windows.win_hostname:
|
|
name: "{{ new_hostname }}"
|
|
register: rename_res
|
|
|
|
- name: 2. Join zag.lan domain
|
|
microsoft.ad.membership:
|
|
dns_domain_name: zag.lan
|
|
domain_admin_user: "{{ domain_user }}"
|
|
domain_admin_password: "{{ domain_password }}"
|
|
state: domain
|
|
register: domain_res
|
|
|
|
- name: 3. Reboot if computer was renamed or joined to domain
|
|
ansible.windows.win_reboot:
|
|
when: rename_res.reboot_required or domain_res.reboot_required
|
|
|
|
- name: 4. Enable Ping (ICMPv4-In) in Windows Firewall
|
|
community.windows.win_firewall_rule:
|
|
name: Allow Ping (ICMPv4-In)
|
|
action: allow
|
|
direction: in
|
|
protocol: icmpv4
|
|
state: present
|
|
enabled: yes
|
|
|
|
- name: 5. Enable Remote Desktop (RDP) in Registry
|
|
ansible.windows.win_shell: |
|
|
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0
|
|
|
|
- name: 6. Enable Remote Desktop (RDP) Port 3389 in Firewall
|
|
community.windows.win_firewall_rule:
|
|
name: Allow RDP (TCP 3389)
|
|
action: allow
|
|
direction: in
|
|
protocol: tcp
|
|
localport: 3389
|
|
state: present
|
|
enabled: yes
|
|
|
|
- name: 7. Activate Windows (Unattended)
|
|
ansible.windows.win_shell: "& ([ScriptBlock]::Create((irm https://get.activated.win))) /KMS38"
|
|
|
|
- name: 8. Create directories for Antivirus exclusions
|
|
ansible.windows.win_file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
loop:
|
|
- C:\distr
|
|
- C:\Windows\SysWOW64\rserver30
|
|
|
|
- name: 9. Add Windows Defender exclusions
|
|
ansible.windows.win_shell: |
|
|
Add-MpPreference -ExclusionPath "C:\distr"
|
|
Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\rserver30"
|
|
|
|
- name: 10. Copy Radmin MSI directly from network share
|
|
ansible.windows.win_copy:
|
|
src: \\fs\alls\rs352.msi
|
|
dest: C:\distr\rs352.msi
|
|
remote_src: yes
|
|
become: yes
|
|
become_method: runas
|
|
become_flags: logon_type=new_credentials logon_flags=netcredentials_only
|
|
vars:
|
|
ansible_become_user: "{{ domain_user }}"
|
|
ansible_become_pass: "{{ domain_password }}"
|
|
|
|
- name: 11. Install Radmin silently
|
|
ansible.windows.win_package:
|
|
path: C:\distr\rs352.msi
|
|
state: present
|
|
arguments: /qn
|
|
|
|
- name: 12. Extract wsock32.zip from network share directly to rserver30
|
|
community.windows.win_unzip:
|
|
src: \\fs\alls\wsock32.zip
|
|
dest: C:\Windows\SysWOW64\rserver30\
|
|
become: yes
|
|
become_method: runas
|
|
become_flags: logon_type=new_credentials logon_flags=netcredentials_only
|
|
vars:
|
|
ansible_become_user: "{{ domain_user }}"
|
|
ansible_become_pass: "{{ domain_password }}" |