Win32NT-common.yml

---
- name: Install applications
  win_chocolatey:
    name: "{{ common_windows_packages }}"
  register: result
  until: result is succeeded

- name: Install openssh
  win_chocolatey:
    name: openssh
    params: /SSHServerFeature /KeyBasedAuthenticationFeature

- name: Disable common authorized key file for administrators group in sshd_config
  win_lineinfile:
    path: '%ProgramData%\ssh\sshd_config'
    regexp: "AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys"
    line: "# AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys"

- name: Firewall rule to allow SSH on TCP port 22
  win_firewall_rule:
    name: OpenSSH
    localport: 22
    action: allow
    direction: in
    protocol: tcp

- name: Set Desktop Solid Color
  win_regedit:
    path: 'HKCU:\Control Panel\Colors'
    name: Background
    data: "74 84 89"

- name: Disable Logon Background Image
  win_regedit:
    path: 'HKLM:\Software\Policies\Microsoft\Windows\System'
    name: DisableLogonBackgroundImage
    data: 1
    type: dword

- name: Start NTP service (w32time)
  win_service:
    name: w32time
    state: started
    start_mode: auto

- name: Configure NTP
  win_command: w32tm /config /manualpeerlist:"{{ ntp_servers[0] }}" /reliable:yes /update
  changed_when: false

- name: Remove all current pagefiles
  win_pagefile:
    remove_all: yes
    automatic: no
    state: absent

- name: Disable Hibernate Mode
  win_command: powercfg -h off
  changed_when: false
  when: ansible_distribution is search("Microsoft Windows 10")

- name: Disable Secure Logon using Registry (Ctrl+Alt+Del sequence for logging)
  win_regedit:
    path: 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
    name: DisableCAD
    data: 1
    type: dword

- name: Enable Administrator account
  win_user:
    name: Administrator
    account_disabled: no
  when: ansible_distribution is search("Microsoft Windows 10")

- name: Enable Remote Desktop
  win_regedit:
    path: 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'
    name: fDenyTSConnections
    data: 0
    type: dword

- name: Allow connections from computers running any version of Remote Desktop (less secure)
  win_regedit:
    path: 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'
    name: UserAuthentication
    data: 0
    type: dword

# Can't use ansible module because of: https://github.com/ansible/ansible/issues/32478
- name: Enable Firewall Inbound Rules Group
  win_shell: Enable-NetFirewallRule -DisplayGroup "{{ item }}"
  changed_when: false
  loop:
    - Remote Desktop
    - Windows Remote Management

- name: Use the plaintext WinRM transport and force it to use basic authentication
  win_shell: winrm set winrm/config/service '@{AllowUnencrypted="true"}'

# Can't use ansible module because of: https://github.com/ansible/ansible/issues/32478
- name: Allow ICMP
  win_shell: Set-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" -enabled True
  changed_when: false

- name: Show file extensions in Explorer
  win_regedit:
    path: 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced'
    name: HideFileExt
    data: 0
    type: dword

- name: Show hidden files
  win_regedit:
    path: 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced'
    name: "{{ item }}"
    data: 1
    type: dword
  loop:
    - Hidden
    - SuperHidden

- name: Enable QuickEdit mode
  win_regedit:
    path: 'HKCU:\Console'
    name: QuickEdit
    data: 1
    type: dword
  when: ansible_distribution is search("Microsoft Windows Server 2012")

- name: Enable telnet
  win_feature:
    name: telnet-client
  when: ansible_distribution is not search("Microsoft Windows 10")

- name: Configure PuTTY
  win_regedit:
    path: 'HKCU:\SOFTWARE\SimonTatham\PuTTY\Sessions\Default%20Settings'
    name: "{{ item.name }}"
    data: "{{ item.data }}"
    type: dword
  loop:
    - name: TCPKeepalives
      data: 1
    - name: PingIntervalSecs
      data: 30
    - name: Compression
      data: 1
    - name: AgentFwd
      data: 1
    - name: LinuxFunctionKeys
      data: 1
    - name: MouseIsXterm
      data: 1
    - name: ConnectionSharing
      data: 1

- name: Configure WinSCP
  win_copy:
    src: win/WinSCP.ini
    dest: '%PROGRAMFILES(x86)%\WinSCP\WinSCP.ini'

- name: Enable allowGlobalConfirmation for Chocolatey
  win_chocolatey_feature:
    name: allowGlobalConfirmation

- name: Put Doublecmd link to desktop
  win_copy:
    src: '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Double Commander\Double Commander.lnk'
    dest: '%PUBLIC%\Desktop\'
    remote_src: true

- name: Create config directory for Doublecmd
  win_file:
    path: '%APPDATA%\doublecmd'
    state: directory

- name: Upload Dolublecmd configuration file
  win_copy:
    src: win/doublecmd.xml
    dest: '%APPDATA%\doublecmd\doublecmd.xml'

- name: Add choco upgrade scheduled task
  win_scheduled_task:
    name: choco upgrade
    description: Chocolatey update task - updates all apps installed by Chocolatey
    actions:
      - path: choco.exe
        arguments: upgrade all -y
    triggers:
      - type: daily
        start_boundary: "2017-10-09T01:00:00"
    run_level: highest
    username: SYSTEM

- name: Upload bginfo config file
  win_copy:
    src: win/bginfo.bgi
    dest: '%PROGRAMDATA%\bginfo.bgi'

- name: Start bginfo after login
  win_regedit:
    path: 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
    name: bginfo
    data: 'C:\ProgramData\chocolatey\bin\bginfo.exe C:\ProgramData\bginfo.bgi /silent /timer:0 /nolicprompt'

- name: Install windows updates
  win_updates:
    category_names:
      - Application
      - Connectors
      - CriticalUpdates
      - DefinitionUpdates
      - DeveloperKits
      - FeaturePacks
      - Guidance
      - SecurityUpdates
      - ServicePacks
      - Tools
      - UpdateRollups
      - Updates
  register: windows_updates

- name: Windows reboot
  win_reboot:
    reboot_timeout: 10000
  when: windows_updates.reboot_required and allow_windows_reboot_during_win_updates