Apolonio Blog

I got sysprep working at a minimal level the way I want. I now have a base windows 11 image I can use to rebuild a box relatively quickly.

After a reboot I rename it and add it to the domain.

From there ansible takes over. I am able to use a rocky 9.7 box to manage Windows Desktops via the domain through winrm

Here is how I got winrm working (not I just used a self signed cert)

Enable-PSRemoting -Force
$CertDnsName = "win11.example.com"
$Cert = New-SelfSignedCertificate `
    -DnsName $CertDnsName `
	-Provider "Microsoft RSA SChannel Cryptographic Provider" `
	-KeyLength 2048 -NotAfter (Get-Date).AddYears(5) `
    -CertStoreLocation Cert:\LocalMachine\My
$CertThumbprint = $Cert.Thumbprint

# Create Listener
New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -HostName $CertDnsName -CertificateThumbPrint $CertThumbprint -Force

# Open Firewall
New-NetFirewallRule -DisplayName "Windows Remote Management (HTTPS-In)" -Direction Inbound -LocalPort 5986 -Protocol TCP -Action Allow

# Verify
winrm enumerate winrm/config/listener

On the Linux side I had to make sure I had the correct ansible packages

sudo dnf -y install ansible-core epel-release
sudo dnf -y install krb5-workstation krb5-devel python3-devel gcc python3-passlib apg 
sudo dnf install -y python3-kerberos krb5-workstation

python3 -m pip install pywinrm requests
ansible-galaxy collection install community.general
ansible-galaxy collection install community.mysql
ansible-galaxy collection install ansible.posix
ansible-galaxy collection install ansible.windows:2.3.0

This got me working but my ansible.cfg needed to look like this

[defaults]
inventory = ./inventory
host_key_checking = False
retry_files_enabled = False
stdout_callback = default
timeout = 30
ansible_connection=winrm

# Optional but useful
interpreter_python = auto_silent

[connection]
pipelining = True

[winrm]
# Kerberos settings
transport = kerberos
scheme = https
port = 5986
server_cert_validation = ignore
kerberos_delegation = true

And finally some variables needed to be set in the inventory file

##### Sample inventory
[windows]
win11a.example.com
win11b.example.com
win11c.example.com

[windows:vars]
ansible_connection=winrm
ansible_port=5986
ansible_winrm_transport=kerberos
ansible_winrm_scheme=https
ansible_winrm_server_cert_validation=ignore

kilist
kdestroy
kinit Admin@EXAMPLE.COM

In other news, got a new Sony earbuds, RIP my old set.

Still need to get bathroom done

Got a new UPS to install this weekend.

Weight: 321.6