134 lines
4.5 KiB
YAML
134 lines
4.5 KiB
YAML
---
|
|
# Microsoft Windows specific tasks.
|
|
|
|
# Set the Windows Explorer options.
|
|
# ansible-lint: disable=line-length
|
|
- name: Setting the Windows Explorer options...
|
|
when: ansible_os_installation_type != "Server Core"
|
|
block:
|
|
- name: Show hidden files.
|
|
ansible.windows.win_regedit:
|
|
path: HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
|
|
name: Hidden
|
|
data: 1
|
|
type: dword
|
|
|
|
- name: Show file extensions.
|
|
ansible.windows.win_regedit:
|
|
path: HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
|
|
name: HideFileExt
|
|
data: 0
|
|
type: dword
|
|
|
|
- name: Show drives with no media.
|
|
ansible.windows.win_regedit:
|
|
path: HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
|
|
name: HideDrivesWithNoMedia
|
|
data: 0
|
|
type: dword
|
|
|
|
- name: Disabling Sync Provider Notifications.
|
|
ansible.windows.win_regedit:
|
|
path: HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
|
|
name: ShowSyncProviderNotifications
|
|
data: 1
|
|
type: dword
|
|
|
|
# Disable system hibernation.
|
|
- name: Disabling System Hibernation...
|
|
block:
|
|
- name: Disabling Hibernation.
|
|
ansible.windows.win_regedit:
|
|
path: HKLM:\SYSTEM\CurrentControlSet\Control\Power
|
|
name: HibernateEnabled
|
|
data: 0
|
|
type: dword
|
|
|
|
- name: Setting HiberFileSizePercent to 0.
|
|
ansible.windows.win_regedit:
|
|
path: HKLM:\SYSTEM\CurrentControlSet\Control\Power
|
|
name: HiberFileSizePercent
|
|
data: 0
|
|
type: dword
|
|
|
|
# Disable TLS 1.0.s
|
|
- name: Disabling TLS 1.0 for Client...
|
|
block:
|
|
- name: Disabling TLS 1.0 for Client.
|
|
ansible.windows.win_regedit:
|
|
path: HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
|
|
name: Enabled
|
|
data: 0
|
|
type: dword
|
|
|
|
- name: Setting TLS 1.0 for Client to Disabled by Default.
|
|
ansible.windows.win_regedit:
|
|
path: HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
|
|
name: DisabledByDefault
|
|
data: 1
|
|
type: dword
|
|
|
|
- name: Disabling TLS 1.0 for Server.
|
|
ansible.windows.win_regedit:
|
|
path: HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
|
|
name: Enabled
|
|
data: 0
|
|
type: dword
|
|
|
|
- name: Setting TLS 1.0 for Server to Disabled by Default.
|
|
ansible.windows.win_regedit:
|
|
path: HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
|
|
name: DisabledByDefault
|
|
data: 1
|
|
type: dword
|
|
|
|
# Disable TLS 1.1.
|
|
- name: Disabling TLS 1.1 for Client...
|
|
block:
|
|
- name: Disabling TLS 1.1 for Client.
|
|
ansible.windows.win_regedit:
|
|
path: HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client
|
|
name: Enabled
|
|
data: 0
|
|
type: dword
|
|
|
|
- name: Setting TLS 1.1 for Client to Disabled by Default.
|
|
ansible.windows.win_regedit:
|
|
path: HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client
|
|
name: DisabledByDefault
|
|
data: 1
|
|
type: dword
|
|
|
|
- name: Disabling TLS 1.1 for Server.
|
|
ansible.windows.win_regedit:
|
|
path: HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
|
|
name: Enabled
|
|
data: 0
|
|
type: dword
|
|
|
|
- name: Setting TLS 1.1 for Server to Disabled by Default.
|
|
ansible.windows.win_regedit:
|
|
path: HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
|
|
name: DisabledByDefault
|
|
data: 1
|
|
type: dword
|
|
|
|
# Disable Password Expiration for Administrator and Build Accounts
|
|
- name: Disabling Local Administrator Password Expiration...
|
|
ansible.windows.win_user:
|
|
name: Administrator
|
|
password_never_expires: true
|
|
|
|
- name: Disabling Password Expiration for "{{ build_username }}"
|
|
ansible.windows.win_user:
|
|
name: "{{ build_username }}"
|
|
password_never_expires: true
|
|
|
|
# Enable Remote Desktop.
|
|
- name: Enabling Remote Desktop...
|
|
ansible.windows.win_powershell:
|
|
script: |
|
|
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 0 | Out-Null
|
|
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "UserAuthentication" -Value 0
|
|
Enable-NetFirewallRule -Group '@FirewallAPI.dll,-28752'
|