Matt Davis, Senior Principal Software Engineer at Ansible Core: Red HatWindows can be a fickle beast to automate. We'll explore ten common Windows pain points and how to tame them via Ansible, then explore an Ansible role that builds on those techniques to deploy a Chocolatey Simple Server.

1. 10 Things I Hate About You:
Taming Windows with Ansible
Matt Davis
Senior Principal Software Engineer, Ansible Core

2. Who am I?

3. I LOVE WINDOWS

5. ● Simple, agentless orchestration
○ Push-mode, linear by default
○ Uses target-native management technologies
● F/OSS command-line, "batteries included"
○ Tower Web UI/Service layer available
○ Sorry, controller is Linux-y (for now)
● Talk to just about anything
○ Windows, Linux, Networking, Embedded
What is Ansible?

6. ● List of machines to manage (and how to reach them)
● Static
○ Simple
● Dynamic
○ Source from anything/anywhere!
● Composable
○ Most real-world inventories are both
Ansible Basics: Inventory

7. ● Unit of code that executes on a target
● Samples/enforces desired state on a resource
○ Similar to a DSC Resource
● Idempotent!
● Ephemeral!
Ansible Basics: Modules

8. ● A series of YAML-based declarative tasks
● Usually drives modules against inventory hosts
● Embedded Jinja2 templating
● Default task-linear/host-parallel
○ Easy orchestration!
● Easy error recovery!
Ansible Basics: Playbooks

9. ● Packaged tasks from playbooks
○ Declare defaults, include templates
○ Easy reuse/distribution format
We'll take a look at all these in a bit!
Ansible Basics: Roles

10. ● Windows-native HTTP/XML remote shell protocol
● Non-interactive logon
● Microsoft OpenSSH?
WinRM

11. DEMOS:
Ansible Installation
Ansible Inventory
WinRM Connectivity

12. ● Unlike Python, "just there" on modern Windows
● We can use .NET
● Powershell 3+, Windows 7/Server 2008+
● Access to the DSC universe via win_dsc
Powershell

13. - win_psmodule: # install xDNSServer DSC module on target
name: xDnsServer
- win_dsc: # create DNS zone
resource_name: xDnsServerPrimaryZone
name: createdbyansible.com
- win_dsc: # create DNS record
resource_name: xDnsRecord
name: test
zone: createdbyansible.com
target: 1.2.3.4
type: ARecord
Powershell / DSC

14. ● win_chocolatey !
● win_package
App Install/Maintenance

15. ● win_reboot action makes managed reboots trivial
● wait_for_connection is just the second half
Reboots, oh the reboots...

16. ● Basic, synchronous updates
● Uses configured source (Windows Update/WSUS)
● Transparent run as SYSTEM + auto reboot
Windows Update

17. - win_updates:
category_names: CriticalUpdates
reboot: yes # new in 2.5!
blacklist: # new in 2.5!
- KB4056892
Windows Update

18. ● Modules for managing websites, webapps, apppools,
virtual dirs, etc.
IIS

19. - win_iis_website:
name: Default Web Site
physical_path: C:InetpubWWWRoot
- win_iis_webapp:
site: Default Web Site
name: OrchardCMS
physical_path: C:InetpubWWWRootOrchard
IIS

20. ● Manage individual key/value (win_regedit)
● Manage idempotent bulk import (win_regmerge)
Registry

21. - win_regedit:
path: HKLMSoftwareMicrosoftWindows
name: SomeValueName
value: 0x12345
- win_regmerge:
path: ComplexRegData.reg
Registry

22. ● win_service
● Basic start/stop
● Provides fine control over complex service behavior
config in Windows SCM
○ who/what/when/how
Services

23. # ensure IIS is running
- win_service:
name: W3Svc
state: running
# ensure firewall service is stopped/disabled
- win_service:
name: MpsSvc
state: stopped
start_mode: disabled
Services

24. ● Windows' way of doing enterprise identity
● Makes auth complex
● Ansible can do "throwaway" domains easily
● Promote/depromote DCs
● Joining/leaving domain is simple
● Manage basic domain objects
Domains

25. # create a domain
- win_domain:
dns_domain_name: mydomain.local
safe_mode_password: ItsASecret
# add a domain user
- win_domain_user:
name: somebody
upn: somebody@mydomain.local
groups:
- Domain Admins
Domains

26. DEMO: Domain Join

27. ● win_acl / win_owner
● SDDL?!
ACLs

28. O:BAG:S-1-5-21-328427983-2845905853-4261175022-
513D:AI(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OIC
ID;LC;;;BU)(A;CIID;DC;;;BU)(A;OICIIOID;GA;;;CO)
ACLs

29. - win_owner:
path: C:Program FilesSomeApp
user: Administrator
recurse: true
- win_acl:
path: C:Temp
user: Users
rights: ReadAndExecute,Write,Delete
inherit: ContainerInherit,ObjectInherit
ACLs

30. DEMO:
Choco Simple Server Install

31. Wrapup

32. + =

33. Questions?