Ansible for Microsoft's Windows

Hello

Thanks for visiting RvKmR's blogs

Today we are discussing managing Microsoft Windows machines with Ansible. We know that managing Linux machines with Ansible is quite common nowadays. but managing windows machines with Ansible is quite new. SSH service is used to manage Linux machine and for windows WinRM. Please check more details about WinRM here.

Lets checkout steps to configure WINRM for ansible. Below are requirements for WINRM configuration on target windows machine.

• Admin Credentials of target windows machine.
• Stop firewall on target windows machine.
• Powershell version 3.0 and .net framework 4.0

Let's start configuring Windows machine:

• I am considering you have administrator account credentials with you.
• Open Firewall in windows machines and turn of it or allow port 5985 and 5986.
• Update Powershell and .Net Framework with below commands on PowerShell.

$url ="https://raw.githubusercontent.com/jborean93/ansible-windows/master/scripts/Upgrade-PowerShell.ps1"

$file = "$env:temp\Upgrade-PowerShell.ps1"

$username = "Administrator"

$password = "Password"

(New-Object -TypeName System.Net.WebClient).DownloadFile($url, $file)

Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Force

# Version can be 3.0, 4.0 or 5.1

&$file -Version 5.1 -Username $username -Password $password -Verbose

# This isn't needed but is a good security practice to complete

Set-ExecutionPolicy -ExecutionPolicy Restricted -Force

$reg_winlogon_path = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"

Set-ItemProperty -Path $reg_winlogon_path -Name AutoAdminLogon -Value 0

Remove-ItemProperty -Path $reg_winlogon_path -Name DefaultUserName -ErrorAction SilentlyContinue

Remove-ItemProperty -Path $reg_winlogon_path -Name DefaultPassword -ErrorAction SilentlyContinue

• To do WinRM hotfix run below commands on PowerShell.

$url = "https://raw.githubusercontent.com/jborean93/ansible-windows/master/scripts/Install-WMF3Hotfix.ps1"











$file = "$env:temp\Install-WMF3Hotfix.ps1"
















(New-Object -TypeName System.Net.WebClient).DownloadFile($url, $file)







powershell.exe -ExecutionPolicy ByPass -File $file -Verbose

• To Configure WinRM run below commands on PowerShell.

$url = "https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1"











$file = "$env:temp\ConfigureRemotingForAnsible.ps1"
















(New-Object -TypeName System.Net.WebClient).DownloadFile($url, $file)















powershell.exe -ExecutionPolicy ByPass -File $file

• To check WinRM Configuration run below command on PowerShell.

winrm enumerate winrm/config/Listener

If you got below output of above command, then you have configured WinRM successfully.

Now let's configure the ansible machine:

• First, you need to install supported python library for ansible to connect WinRM.

sudo pip install pywinrm

• Now you need to add below variables in ansible inventory for Windows machine.

[all]

192.168.0.101

[all:vars]

ansible_connection=winrm

ansible_winrm_server_cert_validation=ignore

ansible_user='XXXXXXXXXX'

ansible_password='xxxxxxxxx'

ansibl_port=5986

ansible_winrm_transport=ntlm

• Now test connectivity to Windows machine with below ansible command.

ravikumar@ravikumar-RV409-RV509-RV709:~/workspace$ ansible 192.168.0.101 -m win_ping -i inv 

192.168.0.101 | SUCCESS => {

    "changed": false, 

    "ping": "pong"

}

Now you are done with configuration. You can now use windows specific modules for more task on windows machines.