Cloud Admin Club

PowerShell is a framework from Microsoft. it’s heavily used in scripting and task automation. that is to say, PowerShell allows administrators to perform tasks on both local and remote Windows systems as well. hence, This topic aims to enable remote PowerShell execution for Windows by configuring winRM.

Check how to configure Ansible to manage windows.

Keep in mind that Ansible require

Ansible supports Windows 2008 and above. Though, configuration for versions earlier than Windows 2008 R2 is troublesome. for that, upgrade to at least win2008R2.
Ansible requires PowerShell version 3.0 and .NET Framework 4.0 or newer to function because most Ansible modules for windows require at least PowerShell 3.0 or higher to work properly, and Windows 2008 R2 has version 3.0.
A WinRM listener should be created and activated.
You need a centralized Windows privileged user (Administrator@Domain ) if you are going to manage multiple windows servers. It’s a hassle if every server has its distinct username or password.

Configure Windows to accept remote commands

If you have to use older versions of windows please refer to Ansible document to scripts which will allow you to upgrade your PowerShell.

On Windows hosts, you need to enable the Remote Management feature which is a built-in feature but it’s not active by default. Windows Remote Management (WinRM) is the Microsoft implementation of the WS-Management protocol which provides a secure way to communicate with local and remote computers using web services.

You have two easy ways to enable WinRM

One: Enable winRM using Ansible team’s script.

Ansible team provides a script that will configure WinRM. So, to execute that script, follow these steps.

First, Download Ansible PowerShell documentation script from here “Right click and save as ConfigureRemotingForAnsible.ps1”.

Then, allow running unsigned scripts on your local computer and signed scripts from remote, by executing the following command.

set-executionpolicy remotesigned

Next, open a PowerShell as Administrator console

Finally, execute the downloaded script ConfigureRemotingForAnsible.ps1 . the output should be like the following screenshot

Two: use SolarWinds Remote Execution Enabler for PowerShell tool.

That tool is a free desktop app that will configure WinRM on local and remote servers In just one step, in addition, It can do bulk configuration across multiple hosts, also, it will automatically generate and distributes certificates for encrypted remote PowerShell execution.

First, download it from the SolarWinds website. As the installation is simple, then, in a few clicks and finish the installation.

Next, Execute the application from the start menu.

Finally, configure the server, by following these steps:

Enter Server IP
Enter Administrator’s Password.
Click on Start Configuration

As an adventurer, It is time to see how to manages windows using ansible, hence this article is part of a series focus on how to configure ansible for windows automation.

I use Ansible documentation as my reference.

Configure Ansible to connect to Windows servers

Firstly, we will enable Linux network authentication protocol, to allow remote authentication. then, add sever. Finally, we will test our configuration.

You should know that the following instruction will not succeed unless you already configured your Windows to permit remote commands to execute.

Step one: Install few packages

Log into your ansible server. then, install packages for Kerberos, Python package manager.

In this article, I explain using Ubuntu. therefore, If you have ansible on CentOS or Other RPM-based OS check the other article Configure Ansible for Windows Authentication.

At first, Install the following packages

apt-get install -y gcc python3-pip python3-dev libkrb5-dev krb5-user

Secondly, update Python package manager.

pip install --upgrade pip

Finally, install python packages essential for Ansible.

pip install pywinrm Kerberos

Step two: add your server to ansible Inventory

Ansible inventory file is /etc/ansible/hosts, however, you can have multiple inventory files, So, in our adventure, we will create an inventory file to manage windows using ansible.

Ansible Inventory file has the following properties:

It will have a group, So, it makes it easier to manage a group of servers that have the same role.
a variables group, then we will add four variables.
You can add a server by IP, or DNS-name under the group name.

the variables will set how ansible connects to windows server, for example, It will define the credentials and how to validate the SSL certificate used.

In the following example, it shows a simple inventory file for a group of windows 2008 servers. Also, it tells ansible that group is not Linux, locally managed, provides username and password.

[winsrv]
s06
[winsrv:vars]
ansible_connection=winrm
ansible_winrm_server_cert_validation=ignore
ansible_user=Administrator
ansible_password=p@ssw0rd

I usually use servers name instead of IP. I usually add a comment with name and functionality, If I used the IP.

Step three : Test Ansible configuration

I prefer to use multiple inline commands to verify our work, For instance , i use win_ping and win_shell modules.

ansible winsrv -m win_ping

the output should be like this

Other modules, for example both win_command or win_shell allow executing window commands. like command whoami to identify who is executing the command

$ ansible winsrv -m win_shell -a "whoami"
$ ansible winsrv -m win_command -a "whoami"

If results like that

In conclusion, it is easy to configure your server to be managed by Ansible. That is to say, If your servers are domain authenticated, It will be easier. Just flow instructions shown in Kerberos setting for ansible article.

Automation

Enable remote powershell for Windows