郑宏生的Ansible
1、配置 AD域：
01-Windows-AD
---- name: HostName hosts: all gather_facts: False tasks: - name: Hostname ansible.windows.win_hostname: name: "{{ inventory_hostname }}-host" notify: Reboot handlers: - name: Reboot ansible.windows.win_reboot: changed_when: False- name: Install ADDS hosts: all gather_facts: False tasks: - name: Install ad-domain ansible.windows.win_feature: name: AD-Domain-Services include_sub_features: true include_management_tools: true state: present notify: Reboot - name: Config AD-Domain ansible.windows.win_domain: dns_domain_name: "{{ inventory_hostname }}.com" safe_mode_password: Skills39 notify: Reboot handlers: - name: Reboot ansible.windows.win_reboot: changed_when: False- name: Get Recycle hosts: all gather_facts: False tasks: - name: Block block: - name: Enable Recycle Bin ansible.windows.win_shell: | Import-Module ActiveDirectory Enable-ADOptionalFeature 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target "{{ inventory_hostname }}" -Confirm:$false no_log: true changed_when: False rescue: - name: rescue Get Recycle Bin ansible.windows.win_shell: Get-ADOptionalFeature -Identity 'Recycle Bin Feature' | Select-Object -ExpandProperty EnabledScopes register: command_output changed_when: False always: - name: always Get Recycle Bin ansible.windows.win_shell: Get-ADOptionalFeature -Identity 'Recycle Bin Feature' | Select-Object -ExpandProperty EnabledScopes register: command_output changed_when: False - name: Debug debug: msg: "AD回收站功能已启用: {{ command_output.stdout }}"
2、修改组策略
export_enable
02-1-windows-user
---- name: Config Password hosts: all gather_facts: False tasks: - name: Copy Policy ansible.builtin.win_copy: src: /etc/ansible/data/export_enable.inf dest: C:\export.inf changed_when: False - name: Update Policy ansible.windows.win_shell: | secedit /configure /db C:\Windows\Security\new.sdb /cfg C:\export.inf gpupdate /force changed_when: False - name: Update Users Password community.windows.win_domain_user: name: "{{ item }}" password: Skills39 state: present changed_when: False with_items: - user001 - user002
3、创建用户：
export_no
02-Windows-user
---- name: add user hosts: all gather_facts: False tasks: - name: Copy ansible.builtin.win_copy: src: /etc/ansible/data/export_no.inf dest: C:\export.inf changed_when: False - name: Import GPO ansible.windows.win_shell: | secedit /configure /db C:\Windows\Security\new.sdb /cfg C:\export.inf gpupdate /force changed_when: False - name: add users community.windows.win_domain_user: name: "{{ item }}" password: 123456 state: present groups: - Domain Users - Domain Admins changed_when: False with_items: - user001 - user002
4、配置CA：
03-windows-ca
---- name: Config Root-CA hosts: test2 gather_facts: False tasks: - name: Config CA Service On the Test2 machine ansible.windows.win_feature: name: ADCS-Cert-Authority include_sub_features: True include_management_tools: True changed_when: False - name: Enable CA block: - name: Enable CA Certificate ansible.windows.win_shell: Install-AdcsCertificationAuthority -CAType EnterpriseRootCA -KeyLength 2048 -HashAlgorithm SHA256 -ValidityPeriod Years -ValidityPeriodUnits 10 -CACommonName "Root-CA" -Confirm:$false no_log: True changed_when: False rescue: - name: Return result ansible.windows.win_shell: Get-WindowsFeature -Name ADCS-Cert-Authority changed_when: False always: - name: Reture data ansible.windows.win_shell: Get-WindowsFeature -Name ADCS-Cert-Authority register: ca_output changed_when: False - name: Debug debug: msg: - "ADCS 证书服务已配置完成！" - "{{ ca_output.stdout }}" # - name: Export CA-Certificate # ansible.windows.win_certificate_store: # path: C:\cert.pfx # state: exported # file_type: pkcs12 # password: Skills39 - name: Find CA Certificate hosts: test2 gather_facts: false tasks: - name: Find CA Certificate by Subject ansible.windows.win_find: paths: C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content patterns: 'Cert_*' register: found_cert- name: Export CA Certificate hosts: test2 tasks: - name: Export CA Certificate with Thumbprint ansible.windows.win_certificate_store: path: C:\cert.pfx state: exported file_type: pkcs12 password: Skills39 thumbprint: Cert:\LocalMachine\Root