Scripts and samples for managing Windows settings with Ansible & GPO.
- Set-GPOWithAnsible.ps1 - A script that leverages the PolicyFileEditor Powershell Module to update local Group Policy settings. Designed to be triggered in an Ansible play via the win_powershell module.
- samples - Sample playbook showing a use case for the Set-GPOWithAnsible.ps1 script.
While using this script is generally no more or less safe than manually editing the Registry or clicking around in the Group Policy editor, there are some unique conditions that can arise from using Registry.pol to control certain Windows settings.
Make sure that you read the information on SecPol settings here before you deploy Windows Account Policies or Local Policies settings. Deploying SecPol settings via this script will tattoo the system. This isn't inherently bad, but it can be confusing for administrators who are unaware of how these settings were deployed.
In general, you should expect to have to revert settings via an Ansible playbook that utilizes this same script, rather than relying on any method of manually updating the settings on a particular host.
The PowerShell script requires the PolicyFileEditor module. You can place this into the Program Files\WindowsPowershell\Modules\PolicyFileEditor folder, or store it elsewhere and modify the code to Import-Module from a location of your choosing.
No warranty express or implied. You are responsible for any breakage as a result of using any of the scripts or information within this repository.
See LICENSE file.