55 lines
2.5 KiB
Markdown
55 lines
2.5 KiB
Markdown
**Purpose**:
|
|
You will need to enable secure WinRM management of the Windows devices you are running playbooks against, as compared to the Linux devices. The following powershell script needs to be ran on every Windows device you intend to run Ansible playbooks on:
|
|
|
|
``` powershell
|
|
# Script to configure WinRM over HTTPS on the Hyper-V host
|
|
|
|
# Ensure WinRM is enabled
|
|
Write-Host "Enabling WinRM..."
|
|
winrm quickconfig -force
|
|
|
|
# Generate a self-signed certificate (Optional: Use your certificate if you have one)
|
|
$cert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "hyperv-host.local"
|
|
$certThumbprint = $cert.Thumbprint
|
|
|
|
# Function to delete existing HTTPS listener
|
|
function Remove-HTTPSListener {
|
|
Write-Host "Removing existing HTTPS listener if it exists..."
|
|
$listeners = Get-WSManInstance -ResourceURI winrm/config/listener -Enumerate
|
|
foreach ($listener in $listeners) {
|
|
if ($listener.Transport -eq "HTTPS") {
|
|
Write-Host "Deleting listener with Address: $($listener.Address) and Transport: $($listener.Transport)"
|
|
Remove-WSManInstance -ResourceURI winrm/config/listener -SelectorSet @{Address=$listener.Address; Transport=$listener.Transport}
|
|
}
|
|
}
|
|
Start-Sleep -Seconds 5 # Wait for a few seconds to ensure deletion
|
|
}
|
|
|
|
# Remove existing HTTPS listener
|
|
Remove-HTTPSListener
|
|
|
|
# Confirm deletion
|
|
$existingListeners = Get-WSManInstance -ResourceURI winrm/config/listener -Enumerate
|
|
if ($existingListeners | Where-Object { $_.Transport -eq "HTTPS" }) {
|
|
Write-Host "Failed to delete the existing HTTPS listener. Exiting script."
|
|
exit 1
|
|
}
|
|
|
|
# Create a new HTTPS listener
|
|
Write-Host "Creating a new HTTPS listener..."
|
|
$listenerCmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=`"hyperv-host.local`"; CertificateThumbprint=`"$certThumbprint`"}'"
|
|
Invoke-Expression $listenerCmd
|
|
|
|
# Set TrustedHosts to allow connections from any IP address
|
|
Write-Host "Setting TrustedHosts to allow any IP address..."
|
|
winrm set winrm/config/client '@{TrustedHosts="*"}'
|
|
|
|
# Enable the firewall rule for WinRM over HTTPS
|
|
Write-Host "Enabling firewall rule for WinRM over HTTPS..."
|
|
$existingFirewallRule = Get-NetFirewallRule -DisplayName "WinRM HTTPS" -ErrorAction SilentlyContinue
|
|
if (-not $existingFirewallRule) {
|
|
New-NetFirewallRule -Name "WINRM-HTTPS-In-TCP-PUBLIC" -DisplayName "WinRM HTTPS" -Enabled True -Direction Inbound -Protocol TCP -LocalPort 5986 -RemoteAddress Any -Action Allow
|
|
}
|
|
|
|
Write-Host "Configuration complete. The Hyper-V host is ready for remote management over HTTPS."
|
|
``` |