- Now, I know that some of you
are eager to get started with Windows.
So let's talk about setting up Windows as a managed host
which is a procedure that's a little bit different
but not that much.
Let's go check it out.
So in order to set up Windows as a managed host
you need to know that Ansible
can manage all Windows versions
from Windows 7 and Windows server 2008.
I do recommend you use a recent Windows version
so that you don't face certificates that have expired
for instance.
In Ansible, a specific set of modules
is provided to manage Windows assets.
And we will talk about these modules a bit more later.
Now, in order to manage it with Windows
you need to prepare the Windows host.
In the demo that I'm going to do
I'm going to install Windows 2019 server standards.
The 180 day evaluation version will do.
Also on that host you need to make sure
there's Windows also with admin privileges.
On the host login is so with the administrative privileges
and in a powershell use winrm quickconfig to set it up.
And then check the Ansible documentation.
In the Ansible documentation
there are some Windows remote manager wizard read
that you need to run, and it is just an easy copy paste
if you work from the documentation.
And after doing so,
you can verify using winrm enumerate winrm/config/Listener
and verify that http as well as http listeners are available
for the Windows, remote manager, remote contact.
And hey in case you're wondering, what is this all about?
Well, this is all about affected Windows cannot use SSH.
Windows is using Windows remote manager
as default remote management solution.
So we need to tell Ansible about it.
Last step before you can move back to the control node
is where you are going to check out
the Windows control panel and create an Ansible user
with a password and make this user an administrator
such that this user is capable
of configuring your Windows machine.
Let's go and check out a Windows machine
and make sure it's manageable.
So here is the Windows machine, as you can see
I've already been looking at it in the PowerShell
and now that we are in PowerShell as administrator,
might as well continue from there, winrm quickconfig,
the first thing that we need to do.
And make these changes?
Yeah, I wanna make these changes
and that'll update Windows remote manager
for a remote management.
Next, I need to go to the server manager
and on local server
I need to go to the IE enhanced security configuration.
This is a security configuration
that makes Internet Explorer, unusable.
So I'm setting everything to off
'cause I wanna be able to use more
than just trusted websites.
And now I can go to Internet Explorer
and I do not want to use the recommended settings.
And in the Internet Explorer
I am going to https://docs.ansible.com
/ansible/latest /user_guide/Windows_setup.html
That is bringing us to the Windows setup guide.
And there, I need to scroll down a little bit
and this is the part that I need.
So this is the WinRM setup.
And the good thing is I can just copy all of this.
And then I'm going back to the PowerShell
and I'm running it from there.
And that will set up the Windows remote manager
with basic authentication configuration,
basic authentication configuration.
If you need more than that
you need some additional things to be done.
We'll talk about it in a minute.
But first I would like to check
if it's all working as expected.
So I'm using winrm,
enumerate
winrm/config/Listener.
And that is showing us that we have listeners.
We have an http listener.
We have an https listener
and that's exactly what I need at this point.
Then there is one more thing
and that is something I need to do
from the Windows control panel.
So let's go check out the control panel.
There we go.
And in the control panel, I need Ansible user.
So I'm going to the user accounts and in user accounts
I am managing another account.
I'm adding a user account and my user account is Ansible.
I need to set a very secret password.
Windows has these security rules for the passwords.
And then I'm clicking next
and that'll create a local account.
Now I first need to finish that.
And then I can select the user account
and change the account type.
And I'm going to make this user account an administrator.
So that is now done and that means that we are done
with the Windows part of the configuration.
Let's get back to the slide
so that we can check out what is next.
So before we continue,
we need to talk about Windows authentication a bit
because Windows supports different authentication protocols.
If authentication, as we configure to a strict protocol
on Windows, you may have to set up Ansible accordingly
and that makes it a little bit more complex.
So on Windows, there's a couple of options.
There's basic, which only supports local accounts.
Don't use it.
There is certificate which only supports local accounts.
Also don't use it.
There's Kerberos.
Kerberos is pretty common
but it only works for active directory accounts.
That is cool, but it's a little bit too much
for what I want to do in this video course.
There's NTLM and NTLM works for local
as well as AD accounts, which is pretty cool.
There's also CredSSP.
CredSSP offers best support for local
as well as active directory accounts
which is cool as well.
If you need to set up Ansible,
then in the Ansible dot CFG file for your Windows machine
there's this parameter, ansible_winrm_transport.
Set it to CredSSP if you have authentication issues
and that'll fix most of the issues.
Let's check out some other configuration options
that you can do on a control host.
So on the Ansible control host
it is recommended to create a Windows product directly
so that Windows has its own Ansible.cfg,
has its own inventory.
You can check out my GitHub repository for some examples.
Then you need to make sure
that an ATC hosts you have host name resolution
to the Windows box.
Notice that you cannot ping Windows by default,
that's security.
For the simple reason that Windows firewall
disallows incoming ping.
Next on Ansible control,
you need sudo pip three install pywinrm.
Now, what is that all about?
Well, that is about telling python
about how to install and manage Windows.
You will notice that this is often required
if you wanna go beyond managing Linux with Ansible
you need PIP install to install additional stuff.
And this is the first time that we are seeing it.
And once you have done all of this,
you should be able to do a simple command
like ansible win minus I inventory minus M win_ping.
That's the win_ping module that is going to ping
or Ansible win minus I inventory minus M setup
which is going to check facts.
Now let's go do it.
So here I'm on the Ansible control machine
in the Ansible CVC git repository.
Before we are going to do anything,
I need to install the PIP packets.
So sudo dnf install python-pip should take care of it.
So let me do sudo dnf search python grep pip.
And what do we see?
We see Python three PIP, no arc.
That sounds good enough.
So sudo dnf install python3-pip should install it
and oh, already installed.
Well, that is good.
So PIP is showing me what?
PIP is showing me that the name is not PIP.
The name is PIP three, right?
Sudo pip three install pywinrm.
Just ignore the complaint
about running PIP way to root privileges.
In this case, we do need the root privileges.
I am going to the Windows directory
in the course git repository.
And in the Windows directory we have inventory.
So what is in inventory?
In inventory, we have the required information.
I can clean that up a little bit
because the only thing I need is the win group.
This inventory has some variables as well.
I'll tell you all about inventory variables later, not now.
I do need to change my password
to set it to this very secret password.
Hey, no worries.
We can enter passwords in a much more secure way,
but for now, this is good enough.
I'll teach you about Ansible vault
and stuff like that later as well.
So this is not how you are going to use it in real life.
Now we have the Ansible connection
and the Ansible winrm server search validation
set to ignore that should be doing it.
And with it, I should be able to use the Ansible commands.
What do we have in ansible.cfg?
In ansible.cfg,
you can see the privilege escalation parameters
are not there because these need to be specific for Windows.
And these are defined right now in inventory
which is also an option.
So I can just use Ansible win minus M win ping.
So the win in this command
is addressing the Windows house group
and minus M win ping is using the Windows ping module.
Let's give it some time
and then hopefully it'll get back with a pong.
There we go.
Windows is answering with a pong
and it means that we are good
and everything else will be covered later
in this video course where I have a specialized lesson
that's all about the things that you can do with Windows.