ansible:windows
Ez a dokumentum egy előző változata!
Tartalomjegyzék
Windows szerver kezelése Ansible programmal
Adminisztrátorként futtatott PowerShell parancssorban adjuk ki az alábbi utasításokat a TerminalServer szolgáltatás engedélyezéséhez:
PS C:\Users\Administrator> Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -name 'fDenyTSConnections' -Value 0
PS C:\Users\Administrator> Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -name 'fDenyTSConnections'
fDenyTSConnections : 0
PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal S
erver
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
PSChildName : Terminal Server
PSDrive : HKLM
PSProvider : Microsoft.PowerShell.Core\Registry
PS C:\Users\Administrator> Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
PS C:\Users\Administrator> Get-Service TermService Status Name DisplayName ------ ---- ----------- Running TermService Remote Desktop Services
Adminisztrátorként futtatott PowerShell parancssorban adjuk ki az alábbi utasításokat a WinRM szolgáltatás engedélyezéséhez:
Szolgáltatás konfigurálása
PS C:\Users\Administrator> winrm quickconfig
Szolgáltatás engedélyezése és ellenőrzése
PS C:\Users\Administrator> Enable-PSRemoting -Force
PS C:\Users\Administrator> Get-Service WinRM
Status Name DisplayName
------ ---- -----------
Running WinRM Windows Remote Management (WS-Manag...
PS C:\Users\Administrator> Get-Service WinRM | Select-Object StartType
StartType
---------
Automatic
PS C:\Users\Administrator> winrm enumerate winrm/config/listener
Listener
Address = *
Transport = HTTP
Port = 5985
Hostname
Enabled = true
URLPrefix = wsman
CertificateThumbprint
ListeningOn = 127.0.0.1, 192.168.110.51, ::1, fe80::317d:e4ae:1de6:e99c%4
PS C:\Users\Administrator> Test-WSMan
wsmid : http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd
ProtocolVersion : http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd
ProductVendor : Microsoft Corporation
ProductVersion : OS: 0.0.0 SP: 0.0 Stack: 3.0
PS C:\Users\Administrator> winrm get winrm/config/service
Service
RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
MaxConcurrentOperations = 4294967295
MaxConcurrentOperationsPerUser = 1500
EnumerationTimeoutms = 240000
MaxConnections = 300
MaxPacketRetrievalTimeSeconds = 120
AllowUnencrypted = false
Auth
Basic = false
Kerberos = true
Negotiate = true
Certificate = false
CredSSP = false
CbtHardeningLevel = Relaxed
DefaultPorts
HTTP = 5985
HTTPS = 5986
IPv4Filter = *
IPv6Filter = *
EnableCompatibilityHttpListener = false
EnableCompatibilityHttpsListener = false
CertificateThumbprint
AllowRemoteAccess = true
Engedélyezzük a megfelelő hitelesítési eljárást
PS C:\Users\Administrator> winrm set winrm/config/service/auth '@{Basic="false";Kerberos="true";Negotiate="true"}'
Auth
Basic = false
Kerberos = true
Negotiate = true
Certificate = false
CredSSP = false
CbtHardeningLevel = Relaxed
Ellenőrizzük a tűzfal szabályrendszert
PS C:\Users\Administrator> Get-NetFirewallRule -DisplayGroup "Windows Remote Management"
Name : WINRM-HTTP-In-TCP
DisplayName : Windows Remote Management (HTTP-In)
Description : Inbound rule for Windows Remote Management via WS-Management. [TCP 5985]
DisplayGroup : Windows Remote Management
Group : @FirewallAPI.dll,-30267
Enabled : False
Profile : Domain, Private
Platform : {}
Direction : Inbound
Action : Allow
EdgeTraversalPolicy : Block
LooseSourceMapping : False
LocalOnlyMapping : False
Owner :
PrimaryStatus : OK
Status : The rule was parsed successfully from the store. (65536)
EnforcementStatus : NotApplicable
PolicyStoreSource : PersistentStore
PolicyStoreSourceType : Local
RemoteDynamicKeywordAddresses : {}
Name : WINRM-HTTP-In-TCP-PUBLIC
DisplayName : Windows Remote Management (HTTP-In)
Description : Inbound rule for Windows Remote Management via WS-Management. [TCP 5985]
DisplayGroup : Windows Remote Management
Group : @FirewallAPI.dll,-30267
Enabled : False
Profile : Public
Platform : {}
Direction : Inbound
Action : Allow
EdgeTraversalPolicy : Block
LooseSourceMapping : False
LocalOnlyMapping : False
Owner :
PrimaryStatus : OK
Status : The rule was parsed successfully from the store. (65536)
EnforcementStatus : NotApplicable
PolicyStoreSource : PersistentStore
PolicyStoreSourceType : Local
RemoteDynamicKeywordAddresses : {}
Engedélyezzük a hozzáférést
PS C:\Users\Administrator> Enable-NetFirewallRule -DisplayGroup "Windows Remote Management"
Ismét ellenőrizzük a tűzfal szabályrendszert
PS C:\Users\Administrator> Get-NetFirewallRule -DisplayGroup "Windows Remote Management"
Name : WINRM-HTTP-In-TCP
DisplayName : Windows Remote Management (HTTP-In)
Description : Inbound rule for Windows Remote Management via WS-Management. [TCP 5985]
DisplayGroup : Windows Remote Management
Group : @FirewallAPI.dll,-30267
Enabled : True
Profile : Domain, Private
Platform : {}
Direction : Inbound
Action : Allow
EdgeTraversalPolicy : Block
LooseSourceMapping : False
LocalOnlyMapping : False
Owner :
PrimaryStatus : OK
Status : The rule was parsed successfully from the store. (65536)
EnforcementStatus : NotApplicable
PolicyStoreSource : PersistentStore
PolicyStoreSourceType : Local
RemoteDynamicKeywordAddresses : {}
Name : WINRM-HTTP-In-TCP-PUBLIC
DisplayName : Windows Remote Management (HTTP-In)
Description : Inbound rule for Windows Remote Management via WS-Management. [TCP 5985]
DisplayGroup : Windows Remote Management
Group : @FirewallAPI.dll,-30267
Enabled : True
Profile : Public
Platform : {}
Direction : Inbound
Action : Allow
EdgeTraversalPolicy : Block
LooseSourceMapping : False
LocalOnlyMapping : False
Owner :
PrimaryStatus : OK
Status : The rule was parsed successfully from the store. (65536)
EnforcementStatus : NotApplicable
PolicyStoreSource : PersistentStore
PolicyStoreSourceType : Local
RemoteDynamicKeywordAddresses : {}
Ellenőrizzük a szolgáltatást az ansible oldalon
[ansible@ansible ~]$ curl -v http://192.168.110.51:5985/wsman * Trying 192.168.110.51:5985... * Connected to 192.168.110.51 (192.168.110.51) port 5985 * using HTTP/1.x > GET /wsman HTTP/1.1 > Host: 192.168.110.51:5985 > User-Agent: curl/8.12.1 > Accept: */* > * Request completely sent off < HTTP/1.1 405 < Allow: POST < Server: Microsoft-HTTPAPI/2.0 < Date: Tue, 26 May 2026 07:27:53 GMT < Connection: close < Content-Length: 0 < * shutting down connection #0
Rendszerinformációk
Ansible "tények" lekérdezése
Hozzunk létre egyszerű, ansible tényeket lekérdező ansible playbook állományt
- 01-facts.yaml
- hosts: windows gather_facts: true tasks: - debug: var: ansible_facts
Futtassuk a playbook-ot
[ansible@ansible ~]$ ansible-playbook 01-facts.yaml
PLAY [windows] *****************************************************************
TASK [Gathering Facts] *********************************************************
ok: [win2022]
TASK [debug] *******************************************************************
ok: [win2022] => {
"ansible_facts": {
"architecture": "64-bit",
"architecture2": "x86_64",
"bios_date": "11. 17. 2024",
"bios_version": "edk2-20241117-4.el9_7.3",
"date_time": {
"date": "2026-05-25",
"day": "25",
"epoch": "1779775803,95348",
"epoch_int": 1779775804,
"epoch_local": "1779750603,95348",
"hour": "23",
"iso8601": "2026-05-26T06:10:03Z",
"iso8601_basic": "20260525T231003953480",
"iso8601_basic_short": "20260525T231003",
"iso8601_micro": "2026-05-26T06:10:03.953480Z",
"minute": "10",
"month": "05",
"second": "03",
"time": "23:10:03",
"tz": "Pacific Standard Time",
"tz_offset": "-07:00",
"weekday": "Monday",
"weekday_number": "1",
"weeknumber": "20",
"year": "2026"
},
"distribution": "Microsoft Windows Server 2022 Standard Evaluation",
"distribution_major_version": "10",
"distribution_version": "10.0.20348.0",
"domain": "",
"env": {
"ALLUSERSPROFILE": "C:\\ProgramData",
"APPDATA": "C:\\Users\\Administrator\\AppData\\Roaming",
"COMPUTERNAME": "WIN-T9R338V1CCC",
"ComSpec": "C:\\Windows\\system32\\cmd.exe",
"CommonProgramFiles": "C:\\Program Files\\Common Files",
"CommonProgramFiles(x86)": "C:\\Program Files (x86)\\Common Files",
"CommonProgramW6432": "C:\\Program Files\\Common Files",
"DriverData": "C:\\Windows\\System32\\Drivers\\DriverData",
"HOMEDRIVE": "C:",
"HOMEPATH": "\\Users\\Administrator",
"LOCALAPPDATA": "C:\\Users\\Administrator\\AppData\\Local",
"LOGONSERVER": "\\\\WIN-T9R338V1CCC",
"NUMBER_OF_PROCESSORS": "2",
"OS": "Windows_NT",
"PATHEXT": ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL",
"PROCESSOR_ARCHITECTURE": "AMD64",
"PROCESSOR_IDENTIFIER": "AMD64 Family 23 Model 17 Stepping 0, AuthenticAMD",
"PROCESSOR_LEVEL": "23",
"PROCESSOR_REVISION": "1100",
"PROMPT": "$P$G",
"PSExecutionPolicyPreference": "Unrestricted",
"PSModulePath": "C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules",
"PUBLIC": "C:\\Users\\Public",
"Path": "C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\System32\\OpenSSH\\;C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\WindowsApps",
"ProgramData": "C:\\ProgramData",
"ProgramFiles": "C:\\Program Files",
"ProgramFiles(x86)": "C:\\Program Files (x86)",
"ProgramW6432": "C:\\Program Files",
"SystemDrive": "C:",
"SystemRoot": "C:\\Windows",
"TEMP": "C:\\Users\\ADMINI~1\\AppData\\Local\\Temp",
"TMP": "C:\\Users\\ADMINI~1\\AppData\\Local\\Temp",
"USERDOMAIN": "WIN-T9R338V1CCC",
"USERDOMAIN_ROAMINGPROFILE": "WIN-T9R338V1CCC",
"USERNAME": "Administrator",
"USERPROFILE": "C:\\Users\\Administrator",
"windir": "C:\\Windows"
},
"fqdn": "WIN-T9R338V1CCC",
"gather_subset": [
"all"
],
"hostname": "WIN-T9R338V1CCC",
"interfaces": [
{
"connection_name": "Ethernet Instance 0",
"default_gateway": "192.168.110.1",
"dns_domain": null,
"interface_index": 4,
"interface_name": "Intel(R) 82574L Gigabit Network Connection",
"ipv4": {
"address": "192.168.110.51",
"prefix": "24"
},
"ipv6": {
"address": "fe80::317d:e4ae:1de6:e99c%4",
"prefix": "64"
},
"macaddress": "52:54:00:8E:F9:1E",
"mtu": 1500,
"speed": 1000
}
],
"ip_addresses": [
"fe80::317d:e4ae:1de6:e99c%4",
"192.168.110.51"
],
"kernel": "10.0.20348.0",
"lastboot": "2026-05-21 00:04:04Z",
"machine_id": "S-1-5-21-3572516673-4086879683-2416554126",
"memfree_mb": 4399,
"memtotal_mb": 8173,
"module_setup": true,
"netbios_name": "WIN-T9R338V1CCC",
"nodename": "WIN-T9R338V1CCC",
"os_family": "Windows",
"os_install_date": "2026-05-09T02:53:01Z",
"os_installation_type": "Server",
"os_name": "Microsoft Windows Server 2022 Standard Evaluation",
"os_product_type": "server",
"owner_contact": "",
"owner_name": "Windows User",
"pagefilefree_mb": 1061,
"pagefiletotal_mb": 1280,
"powershell_version": 5,
"processor": [
"0",
"AuthenticAMD",
"AMD Ryzen 3 PRO 2200GE w/ Radeon Vega Graphics ",
"1",
"AuthenticAMD",
"AMD Ryzen 3 PRO 2200GE w/ Radeon Vega Graphics "
],
"processor_cores": 2,
"processor_count": 1,
"processor_threads_per_core": 1,
"processor_vcpus": 2,
"product_name": "KVM",
"product_serial": null,
"product_uuid": "5EF55895-6169-4C7E-9E28-23CD198B8D5F",
"reboot_pending": true,
"swaptotal_mb": 0,
"system": "Win32NT",
"system_description": "",
"system_vendor": "Red Hat",
"uptime_seconds": 428761,
"user_dir": "C:\\Users\\Administrator",
"user_gecos": "",
"user_id": "Administrator",
"user_sid": "S-1-5-21-3572516673-4086879683-2416554126-500",
"virtualization_role": "guest",
"virtualization_type": "kvm",
"windows_domain": "WORKGROUP",
"windows_domain_member": false,
"windows_domain_role": "Stand-alone server"
}
}
PLAY RECAP *********************************************************************
win2022 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Windows rendszerinformációk
- 02-osinfo.yaml
[ansible@ansible ~]$ cat 02-osinfo.yaml - hosts: windows gather_facts: false tasks: - name: OS info ansible.windows.win_powershell: script: | Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber, OSArchitecture | ConvertTo-Json -Depth 3 register: osinfo - debug: msg: "{{ osinfo.output[0] }}"
[ansible@ansible ~]$ ansible-playbook 02-osinfo.yaml
PLAY [windows] *****************************************************************
TASK [OS info] *****************************************************************
changed: [win2022]
TASK [debug] *******************************************************************
ok: [win2022] => {
"msg": {
"BuildNumber": "20348",
"Caption": "Microsoft Windows Server 2022 Standard Evaluation",
"OSArchitecture": "64-bit",
"Version": "10.0.20348"
}
}
PLAY RECAP *********************************************************************
win2022 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Felhasználók kezelése
Helyi felhasználó létrehozása
- 03-create-local-user.yaml
- hosts: windows tasks: - name: Create local user ansible.windows.win_user: name: "user1" password: "Linux2026%" state: present password_never_expires: true user_cannot_change_password: true groups: - Users
[ansible@ansible ~]$ ansible-playbook 03-create-local-user.yaml PLAY [windows] ***************************************************************** TASK [Gathering Facts] ********************************************************* ok: [win2022] TASK [Create local user] ******************************************************* changed: [win2022] PLAY RECAP ********************************************************************* win2022 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Helyi felhasználó módosítása
- 03-modify-local-user.yaml
- hosts: windows tasks: - name: Add user1 to local Administrators ansible.windows.win_group_membership: name: Administrators members: - user1 state: present
[ansible@ansible ~]$ ansible-playbook 03-modify-local-user.yaml PLAY [windows] ***************************************************************** TASK [Gathering Facts] ********************************************************* ok: [win2022] TASK [Add user1 to local Administrators] *************************************** changed: [win2022] PLAY RECAP ********************************************************************* win2022 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Helyi felhasználó törlése
- 03-delete-local-user.yaml
- hosts: windows tasks: - name: Delete user profile ansible.windows.win_user_profile: username: user1 state: absent - name: Delete local Windows user ansible.windows.win_user: name: user1 state: absent
[ansible@ansible ~]$ ansible-playbook 03-delete-local-user.yaml PLAY [windows] ***************************************************************** TASK [Gathering Facts] ********************************************************* ok: [win2022] TASK [Delete user profile] ***************************************************** ok: [win2022] TASK [Delete local Windows user] *********************************************** changed: [win2022] PLAY RECAP ********************************************************************* win2022 : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Több felhasználó létrehozása
A felhasználók lekérdezhetők PowerShell segítségével.
Windows oldalon a profil és a felhasználó törlése adminisztrátorként futtatott PS utasítások segítségével elvégezhető:
PS C:\Users\Administrator> Get-CimInstance Win32_UserProfile | Where LocalPath -eq "C:\Users\USERNAME" | Remove-CimInstance PS C:\Users\Administrator> Remove-LocalUser USERNAME
Ugyanez megoldható szkript segítségével
- delete-local-user.ps1
$user = "USERNAME" Get-CimInstance Win32_UserProfile | Where-Object { $_.LocalPath -eq "C:\Users\$USERNAME" } | ForEach-Object { if (-not $_.Loaded) { Remove-CimInstance $_ } }
ansible/windows.1779784739.txt.gz · legutóbbi módosítás: – Szerkesztő: riba.zoltan