AAP 2.6 Windows Automation: WinRM, PowerShell, and Active Directory Management

# Enable WinRM with HTTPS
$cert = New-SelfSignedCertificate -DnsName $env:COMPUTERNAME -CertStoreLocation Cert:\LocalMachine\My
$thumbprint = $cert.Thumbprint

winrm quickconfig -quiet
winrm set winrm/config/service/auth '@{Basic="true"}'
winrm set winrm/config/service '@{AllowUnencrypted="false"}'

# Create HTTPS listener
winrm create winrm/config/Listener?Address=*+Transport=HTTPS "@{Hostname=`"$env:COMPUTERNAME`";CertificateThumbprint=`"$thumbprint`"}"

# Firewall rule
New-NetFirewallRule -Name "WinRM-HTTPS" -DisplayName "WinRM HTTPS" -Enabled True -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow

Invoke-WebRequest -Uri https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1 -OutFile ConfigureRemotingForAnsible.ps1
.\ConfigureRemotingForAnsible.ps1 -EnableCredSSP -ForceNewSSLCert

- name: Create Windows machine credential
  ansible.platform.credential:
    controller_host: "{{ gateway_url }}"
    controller_username: "{{ controller_user }}"
    controller_password: "{{ controller_pass }}"
    name: "Windows Domain Admin"
    organization: "Operations"
    credential_type: "Machine"
    inputs:
      username: "DOMAIN\\ansible_svc"
      password: "{{ vault_windows_password }}"
    state: present

# Group variables for Windows hosts
- name: Create Windows group
  ansible.platform.group:
    controller_host: "{{ gateway_url }}"
    controller_username: "{{ controller_user }}"
    controller_password: "{{ controller_pass }}"
    name: "windows"
    inventory: "Production Windows"
    variables:
      ansible_connection: winrm
      ansible_winrm_transport: ntlm
      ansible_winrm_server_cert_validation: ignore
      ansible_port: 5986
      ansible_winrm_scheme: https
    state: present

# Execution Environment with Kerberos support
---
version: 3
images:
  base_image:
    name: registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9:latest
dependencies:
  python:
    - pywinrm>=0.4.0
    - requests-kerberos>=0.14
    - pykerberos>=1.2
  system:
    - krb5-workstation [platform:rpm]
    - krb5-libs [platform:rpm]
    - krb5-devel [platform:rpm]
additional_build_steps:
  append_final:
    - COPY krb5.conf /etc/krb5.conf

# krb5.conf for the EE
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = true

[realms]
EXAMPLE.COM = {
    kdc = dc01.example.com
    admin_server = dc01.example.com
}

[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM

- name: Install IIS web server
  hosts: windows_webservers
  tasks:
    - name: Install IIS with management tools
      ansible.windows.win_feature:
        name:
          - Web-Server
          - Web-Mgmt-Tools
          - Web-Asp-Net45
          - Web-Net-Ext45
        state: present
        include_management_tools: true
      register: iis_install

    - name: Reboot if required
      ansible.windows.win_reboot:
      when: iis_install.reboot_required

- name: Manage Windows services
  hosts: windows
  tasks:
    - name: Ensure critical services are running
      ansible.windows.win_service:
        name: "{{ item }}"
        start_mode: auto
        state: started
      loop:
        - W32Time
        - WinRM
        - Winmgmt
        - EventLog

    - name: Disable unnecessary services
      ansible.windows.win_service:
        name: "{{ item }}"
        start_mode: disabled
        state: stopped
      loop:
        - RemoteRegistry
        - TlntSvr

- name: Apply Windows updates
  hosts: windows
  tasks:
    - name: Install all critical and security updates
      ansible.windows.win_updates:
        category_names:
          - CriticalUpdates
          - SecurityUpdates
        state: installed
        reboot: true
        reboot_timeout: 3600
      register: update_result

    - name: Report update status
      ansible.builtin.debug:
        msg: |
          Updates installed: {{ update_result.installed_update_count }}
          Reboot required: {{ update_result.reboot_required }}
          Updates: {{ update_result.updates | map(attribute='title') | list }}

- name: Manage Active Directory
  hosts: domain_controllers
  tasks:
    - name: Create organizational unit
      microsoft.ad.ou:
        name: "Automation Managed"
        path: "DC=example,DC=com"
        state: present

    - name: Create service account
      microsoft.ad.user:
        name: "svc_ansible"
        firstname: "Ansible"
        surname: "Service Account"
        password: "{{ vault_svc_password }}"
        path: "OU=Service Accounts,DC=example,DC=com"
        password_never_expires: true
        user_cannot_change_password: true
        state: present

    - name: Create security group
      microsoft.ad.group:
        name: "Ansible Managed Servers"
        path: "OU=Security Groups,DC=example,DC=com"
        scope: global
        category: security
        members:
          add:
            - "svc_ansible"
        state: present

    - name: Add computer to group
      microsoft.ad.group:
        name: "Ansible Managed Servers"
        members:
          add:
            - "WEB01$"
            - "WEB02$"
            - "APP01$"

- name: Configure Group Policy settings via registry
  hosts: windows
  tasks:
    - name: Set audit policy
      ansible.windows.win_regedit:
        path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit
        name: ProcessCreationIncludeCmdLine_Enabled
        data: 1
        type: dword

    - name: Configure Windows Firewall
      community.windows.win_firewall:
        state: enabled
        profiles:
          - Domain
          - Private
          - Public

- name: Deploy IIS website
  hosts: windows_webservers
  tasks:
    - name: Create website directory
      ansible.windows.win_file:
        path: C:\inetpub\myapp
        state: directory

    - name: Deploy application files
      ansible.windows.win_copy:
        src: files/myapp/
        dest: C:\inetpub\myapp\

    - name: Create IIS application pool
      community.windows.win_iis_webapppool:
        name: MyAppPool
        state: started
        attributes:
          managedRuntimeVersion: v4.0
          autoStart: true
          startMode: AlwaysRunning

    - name: Create IIS website
      community.windows.win_iis_website:
        name: MyApp
        state: started
        port: 443
        ssl: true
        physical_path: C:\inetpub\myapp
        application_pool: MyAppPool
        parameters: "logFile.directory:C:\\Logs\\MyApp"

- name: Run PowerShell scripts
  hosts: windows
  tasks:
    - name: Execute inline PowerShell
      ansible.windows.win_powershell:
        script: |
          $services = Get-Service | Where-Object { $_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic' }
          $services | ForEach-Object {
              Write-Output "Starting $($_.Name)..."
              Start-Service $_.Name -ErrorAction SilentlyContinue
          }
          $Ansible.Result = @{
              started = ($services | Measure-Object).Count
          }
      register: ps_result

    - name: Show result
      ansible.builtin.debug:
        msg: "Started {{ ps_result.result.started }} services"

    - name: Run script file
      ansible.windows.win_powershell:
        script: "{{ lookup('file', 'scripts/health-check.ps1') }}"
        parameters:
          Verbose: true
          OutputPath: C:\Reports\health-check.html

- name: Manage certificates
  hosts: windows
  tasks:
    - name: Import PFX certificate
      ansible.windows.win_certificate_store:
        path: C:\certs\webapp.pfx
        password: "{{ cert_password }}"
        store_location: LocalMachine
        store_name: My
        state: present

    - name: Find expiring certificates
      ansible.windows.win_powershell:
        script: |
          $threshold = (Get-Date).AddDays(30)
          $expiring = Get-ChildItem Cert:\LocalMachine\My |
            Where-Object { $_.NotAfter -lt $threshold }
          $Ansible.Result = $expiring | Select-Object Subject, NotAfter, Thumbprint
      register: expiring_certs

    - name: Alert on expiring certs
      ansible.builtin.debug:
        msg: "WARNING: {{ item.Subject }} expires {{ item.NotAfter }}"
      loop: "{{ expiring_certs.result }}"
      when: expiring_certs.result | length > 0

---
version: 3
images:
  base_image:
    name: registry.redhat.io/ansible-automation-platform-26/ee-minimal-rhel9:latest
dependencies:
  galaxy:
    collections:
      - name: ansible.windows
        version: ">=2.5.0"
      - name: community.windows
        version: ">=2.3.0"
      - name: microsoft.ad
        version: ">=1.7.0"
      - name: chocolatey.chocolatey
        version: ">=1.5.0"
  python:
    - pywinrm>=0.4.0
    - requests-ntlm>=1.2
    - requests-kerberos>=0.14
    - pykerberos>=1.2
  system:
    - krb5-workstation [platform:rpm]
    - krb5-libs [platform:rpm]