Windows Images: Ansible Automation

Last updated: July 31, 2026Latest Frontend Version: 2.17.4

Ansible automates Windows image creation end-to-end: system configuration, security hardening, driver installation, tiCrypt component deployment, and application provisioning. This is the recommended approach for organizations maintaining multiple image variants or requiring reproducible builds.

Prerequisites

Requirement	Details
Ansible	2.10+ with the ansible.windows collection
pywinrm	Python WinRM library (pip install pywinrm)
Target VM	A Windows VM with WinRM enabled and reachable from the Ansible control node

Enable WinRM on the Target VM

Run the following in an elevated PowerShell session on the target:

winrm quickconfig -force
Enable-PSRemoting -Force
Set-Item WSMan:\localhost\Service\Auth\Basic -Value $true
Set-Item WSMan:\localhost\Service\AllowUnencrypted -Value $true

caution

These commands enable basic authentication over unencrypted transport for image preparation. For production automation, use HTTPS transport with certificate-based or Kerberos authentication.

Inventory File

all:
  hosts:
    windows_vm:
      ansible_host: 192.168.1.100
      ansible_user: Administrator
      ansible_password: "{{ vault_win_password }}"
      ansible_connection: winrm
      ansible_winrm_transport: basic
      ansible_winrm_server_cert_validation: ignore
      ansible_port: 5985

Variables File

timezone: "Eastern Standard Time"
ntp_server: "time.nist.gov,0x9"

virtio_driver_path: "D:\\virtio-win-guest-tools.exe"

controller_toml_src: "files/controller.toml"
ticrypt_certificates:
  - "files/ticrypt-ca.cer"
  - "files/ticrypt-intermediate.cer"

vm_installer_msi: "files/ticrypt-vm-controller.msi"

# Windows Activation (KMS)
kms_server: "kms-server.example.com"
kms_gvlk: "TVRH6-WHNXV-R9WG3-9XRFY-MY832"  # Change per edition

chocolatey_packages:
  - googlechrome
  - notepadplusplus
  - 7zip

What the Playbook Covers

Task	Description
System configuration	Timezone, regional settings, hibernation, sleep, screen lock
Firewall	Disable Windows Firewall (tiCrypt network handles filtering)
Security hardening	TLS 1.2 enforcement, NTP, RDP encryption + NLA, Edge policies, IE ESC, FIPS 140-2
Windows Activation	Set GVLK, configure KMS server, activate
Server Manager	Disable auto-start at logon
Windows Update	Disable automatic restarts, apply security and critical updates
Windows features & roles	NFS Client, Telnet Client, RD Session Host
BitLocker	Install the BitLocker feature (required for tiCrypt drive encryption)
VirtIO drivers	Install KVM guest drivers
OpenSSH	Disable auto-start (preinstalled on Windows Server)
Application deployment	Install packages via Chocolatey
VM Installer	Deploy controller.toml, import certificates, install the MSI

Example Playbook

Full playbook YAML (click to expand)

---
- name: Configure Windows VM Image
  hosts: windows_vm
  vars_files:
    - vars.yml
  tasks:

    # ── System Configuration ──────────────────────────────────

    - name: Set timezone
      win_timezone:
        timezone: "{{ timezone }}"

    - name: Set regional format
      win_region:
        format: "en-US"
        copy_settings: true

    - name: Disable hibernation
      win_shell: powercfg /h off

    - name: Disable sleep on AC power
      win_shell: |
        powercfg /change standby-timeout-ac 0
        powercfg /change monitor-timeout-ac 0

    - name: Disable lock screen
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization
        name: NoLockScreen
        data: 1
        type: dword

    - name: Disable screen saver
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\Control Panel\Desktop
        name: ScreenSaveActive
        data: 0
        type: dword

    - name: Disable Server Manager auto-start
      win_regedit:
        path: HKLM:\SOFTWARE\Microsoft\ServerManager
        name: DoNotOpenServerManagerAtLogon
        data: 1
        type: dword

    - name: Disable IE Enhanced Security (Admins)
      win_regedit:
        path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}
        name: IsInstalled
        data: 0
        type: dword

    - name: Disable IE Enhanced Security (Users)
      win_regedit:
        path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}
        name: IsInstalled
        data: 0
        type: dword

    # ── Firewall ─────────────────────────────────────────────

    - name: Disable Windows Firewall (all profiles)
      win_shell: Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

    # ── Windows Update Policy ────────────────────────────────

    - name: Disable automatic restart with logged-on users
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
        name: NoAutoRebootWithLoggedOnUsers
        data: 1
        type: dword

    - name: Set Windows Update to download only (no auto-install)
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
        name: AUOptions
        data: 3
        type: dword

    # ── Security Hardening: TLS ───────────────────────────────

    - name: Disable TLS 1.0
      win_regedit:
        path: HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
        name: Enabled
        data: 0
        type: dword

    - name: Disable TLS 1.1
      win_regedit:
        path: HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
        name: Enabled
        data: 0
        type: dword

    - name: Enable TLS 1.2
      win_regedit:
        path: HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
        name: Enabled
        data: 1
        type: dword

    # ── Security Hardening: NTP ───────────────────────────────

    - name: Configure NTP server
      win_regedit:
        path: HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters
        name: NtpServer
        data: "{{ ntp_server }}"
        type: string

    - name: Start W32Time service
      win_service:
        name: W32Time
        start_mode: auto
        state: started

    # ── Security Hardening: RDP ───────────────────────────────

    - name: Set RDP encryption level to High
      win_regedit:
        path: HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
        name: MinEncryptionLevel
        data: 3
        type: dword

    - name: Require Network Level Authentication for RDP
      win_regedit:
        path: HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
        name: UserAuthentication
        data: 1
        type: dword

    # ── Security Hardening: Edge Policies ─────────────────────

    - name: Disable Edge first-run experience
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Edge
        name: HideFirstRunExperience
        data: 1
        type: dword

    - name: Disable Edge password manager
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Edge
        name: PasswordManagerEnabled
        data: 0
        type: dword

    - name: Disable Edge search suggestions
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Edge
        name: SearchSuggestEnabled
        data: 0
        type: dword

    # ── Telemetry and Diagnostic Data Prompt ─────────────────────

    - name: Disable telemetry
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection
        name: AllowTelemetry
        data: 0
        type: dword

    - name: Disable preview builds
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds
        name: AllowBuildPreview
        data: 0
        type: dword

    - name: Disable OOBE privacy experience (Server 2025 diagnostic data prompt)
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Windows\OOBE
        name: DisablePrivacyExperience
        data: 1
        type: dword

    # ── NFS Client ─────────────────────────────────────────────

    - name: Install NFS Client feature
      win_feature:
        name: NFS-Client
        state: present
      register: nfs_feature_result

    - name: Reboot after NFS Client installation
      win_reboot:
      when: nfs_feature_result.reboot_required

    - name: Enable NFS Client service
      win_service:
        name: NfsClnt
        start_mode: auto
        state: started

    - name: Set NFS anonymous UID
      win_regedit:
        path: HKLM:\SOFTWARE\Microsoft\ClientForNFS\CurrentVersion\Default
        name: AnonymousUid
        data: 0
        type: dword

    - name: Set NFS anonymous GID
      win_regedit:
        path: HKLM:\SOFTWARE\Microsoft\ClientForNFS\CurrentVersion\Default
        name: AnonymousGid
        data: 0
        type: dword

    - name: Set NFS to use reserved ports
      win_regedit:
        path: HKLM:\SOFTWARE\Microsoft\ClientForNFS\CurrentVersion\Default
        name: UseReservedPorts
        data: 1
        type: dword

    - name: Set NFS protocols
      win_regedit:
        path: HKLM:\SOFTWARE\Microsoft\ClientForNFS\CurrentVersion\Default
        name: Protocols
        data: 13630719
        type: dword

    - name: Reboot to apply NFS configuration
      win_reboot:

    # ── Windows Features & Roles ────────────────────────────────

    - name: Install Telnet Client
      win_feature:
        name: Telnet-Client
        state: present

    - name: Install Remote Desktop Session Host
      win_feature:
        name: RDS-RD-Server
        state: present

    - name: Enable RDP connections
      win_regedit:
        path: HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server
        name: fDenyTSConnections
        data: 0
        type: dword

    - name: Set unlimited RDP sessions (policy)
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
        name: MaxInstanceCount
        data: 999999
        type: dword

    - name: Set unlimited RDP sessions (RDP-Tcp)
      win_regedit:
        path: HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
        name: MaxInstanceCount
        data: 999999
        type: dword

    - name: Disable clipboard redirection over RDP
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
        name: fDisableClip
        data: 1
        type: dword

    - name: Disable drive redirection over RDP
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
        name: fDisableCdm
        data: 1
        type: dword

    # ── FIPS Mode ─────────────────────────────────────────────

    - name: Enable FIPS 140-2 compliant algorithms
      win_regedit:
        path: HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
        name: Enabled
        data: 1
        type: dword

    # ── Windows Activation ────────────────────────────────────

    - name: Set GVLK
      win_shell: slmgr /ipk "{{ kms_gvlk }}"

    - name: Configure KMS server
      win_shell: slmgr /skms "{{ kms_server }}"

    - name: Activate Windows
      win_shell: slmgr /ato

    # ── BitLocker ─────────────────────────────────────────────

    - name: Install BitLocker feature
      win_feature:
        name: BitLocker
        state: present
      register: bitlocker_result

    - name: Reboot after BitLocker installation
      win_reboot:
      when: bitlocker_result.changed

    # ── VirtIO Drivers ────────────────────────────────────────

    - name: Install VirtIO guest drivers
      win_package:
        path: "{{ virtio_driver_path }}"
        state: present

    # ── OpenSSH ───────────────────────────────────────────────

    - name: Disable OpenSSH auto-start
      win_service:
        name: sshd
        start_mode: disabled
        state: stopped

    # ── RDP Audio Redirection (Optional) ────────────────────────

    - name: Enable Windows Audio Endpoint Builder
      win_service:
        name: AudioEndpointBuilder
        start_mode: auto
        state: started

    - name: Enable Windows Audio
      win_service:
        name: Audiosrv
        start_mode: auto
        state: started

    - name: Allow audio/video playback redirection over RDP
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
        name: fDisableCam
        data: 0
        type: dword

    - name: Allow audio recording redirection over RDP
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
        name: fDisableAudioCapture
        data: 0
        type: dword

    # ── Application Deployment ────────────────────────────────

    - name: Install Chocolatey packages
      win_chocolatey:
        name: "{{ item }}"
        state: present
      loop: "{{ chocolatey_packages }}"

    # ── VM Installer Deployment ───────────────────────────────

    - name: Copy VM Installer MSI
      win_copy:
        src: "{{ vm_installer_msi }}"
        dest: 'C:\Temp\ticrypt-vm-controller.msi'

    - name: Install VM Installer
      win_package:
        path: 'C:\Temp\ticrypt-vm-controller.msi'
        state: present

    - name: Deploy controller.toml
      win_copy:
        src: "{{ controller_toml_src }}"
        dest: 'C:\Program Files\Tera Insights\tiCrypt VM Controller\controller.toml'

    - name: Import tiCrypt certificates
      win_certificate_store:
        path: "{{ item }}"
        store_location: LocalMachine
        store_name: Root
        state: present
      loop: "{{ ticrypt_certificates }}"

    # ── Windows Update ────────────────────────────────────────

    - name: Apply security and critical updates
      win_updates:
        category_names:
          - SecurityUpdates
          - CriticalUpdates
        reboot: yes

Running the Playbook

ansible-playbook -i inventory.yml playbook.yml --ask-vault-pass

tip

Customize the variables file for your environment before running.