Setup windows server as ad dc #56

piroor · 2025-02-10T05:23:34Z

This adds some tasks to setup a Windows Server VM as an Active Directory Domain Controller. Those added tasks are skipped for non-server Windows clients.

yashirot · 2025-02-10T08:07:43Z

Looks good but I will approve after trying whether that actually works.

yashirot · 2025-02-10T08:36:53Z

One task failed in a test run.
Below is an excerpt from last messages:

TASK [Wait for the system to be ready after reboot for AD DC promotion] ************************************************
skipping: [4.241.169.203]

TASK [Setup chocolatey] ************************************************************************************************
fatal: [4.241.169.203]: FAILED! => {"changed": false, "module_stderr": "", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

PLAY RECAP *************************************************************************************************************
4.241.169.203              : ok=27   changed=20   unreachable=0    failed=1    skipped=6    rescued=0    ignored=0


real    9m53.306s
user    0m11.560s
sys     0m4.514s
make: *** [../use-in-common.mk:18: apply] Error 2

Let's talk it over next business day.

yashirot · 2025-02-10T08:39:31Z

It was good that AD DS was successfully there:

yashirot

TASK [Setup chocolatey] ************************************************************************************************
fatal: [4.241.169.203]: FAILED! => {"changed": false, "module_stderr": "", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

Could you check over this failed task?

piroor · 2025-04-28T05:06:56Z

The error around Chocolatey looks to be solved by changes in #59.

yashirot · 2025-04-28T05:58:14Z

I will try it after merging PR #59.

yashirot · 2025-04-28T06:44:42Z

@piroor
Could you please resolve conflicts because of the merged changes in PR #59?

yashirot · 2025-04-28T07:02:22Z

A temporary test run failed with an error below:

TASK [Setup chocolatey] ************************************************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: requests.exceptions.ConnectTimeout: HTTPSConnectionPool(host='74.176.170.216', port=5986): Max retries exceeded with url: /wsman (Caused by ConnectTimeoutError(<urllib3.connection.HTTPSConnection object at 0x7f7ba3a729f0>, 'Connection to 74.176.170.216 timed out. (connect timeout=30)'))
fatal: [74.176.170.216]: FAILED! => {"msg": "Unexpected failure during module execution: HTTPSConnectionPool(host='74.176.170.216', port=5986): Max retries exceeded with url: /wsman (Caused by ConnectTimeoutError(<urllib3.connection.HTTPSConnection object at 0x7f7ba3a729f0>, 'Connection to 74.176.170.216 timed out. (connect timeout=30)'))", "stdout": ""}

PLAY RECAP *************************************************************************************************************
74.176.170.216             : ok=29   changed=22   unreachable=0    failed=1    skipped=6    rescued=0    ignored=0

yashirot · 2025-04-28T07:09:55Z

Running make apply-playbook again ended up with another error:

TASK [Set non-ASCII workgroup name] ************************************************************************************
fatal: [74.176.170.216]: FAILED! => {"changed": true, "msg": "failed to remove computer from domain: Failed to unjoin computer 'firefoxverify' from domain 'example.local' with the following error message: This machine is a domain controller and cannot be unjoined from a domain.", "reboot_required": false}

PLAY RECAP *************************************************************************************************************
74.176.170.216             : ok=3    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0

However this may not be a problem as I think ansible tasks are not idempotent differing from terraform recipes.

piroor · 2025-04-30T02:30:16Z

A temporary test run failed with an error below:

TASK [Setup chocolatey] ************************************************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: requests.exceptions.ConnectTimeout: HTTPSConnectionPool(host='74.176.170.216', port=5986): Max retries exceeded with url: /wsman (Caused by ConnectTimeoutError(<urllib3.connection.HTTPSConnection object at 0x7f7ba3a729f0>, 'Connection to 74.176.170.216 timed out. (connect timeout=30)'))
fatal: [74.176.170.216]: FAILED! => {"msg": "Unexpected failure during module execution: HTTPSConnectionPool(host='74.176.170.216', port=5986): Max retries exceeded with url: /wsman (Caused by ConnectTimeoutError(<urllib3.connection.HTTPSConnection object at 0x7f7ba3a729f0>, 'Connection to 74.176.170.216 timed out. (connect timeout=30)'))", "stdout": ""}

PLAY RECAP *************************************************************************************************************
74.176.170.216             : ok=29   changed=22   unreachable=0    failed=1    skipped=6    rescued=0    ignored=0

This looks happen due to unresponsive server for a while after reboot. We need to run it with some more delay.

piroor · 2025-04-30T02:42:50Z

Running make apply-playbook again ended up with another error:

TASK [Set non-ASCII workgroup name] ************************************************************************************
fatal: [74.176.170.216]: FAILED! => {"changed": true, "msg": "failed to remove computer from domain: Failed to unjoin computer 'firefoxverify' from domain 'example.local' with the following error message: This machine is a domain controller and cannot be unjoined from a domain.", "reboot_required": false}

PLAY RECAP *************************************************************************************************************
74.176.170.216             : ok=3    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0

However this may not be a problem as I think ansible tasks are not idempotent differing from terraform recipes.

Hmm. This error does not happen on my environment.

piroor · 2025-04-30T04:50:49Z

After some retrying I've realized that Windows is restarted by Ansible itself and we need to wait until reconnected whether AD DC promotion is proceeded or not. The commit d8907bc applies "ansible.builtin.wait_for_connection" before further operations.

yashirot · 2025-05-01T05:18:28Z

In a test run a subsequent task failed.
Below is an excerpt of PLAY RECAP

TASK [Promote to a domain controller if this is Windows Server] ********************************************************
fatal: [74.176.136.13]: FAILED! => {"changed": false, "cmd": "powershell.exe -command \"Install-ADDSForest -DomainName example.local -SafeModeAdministratorPassword (ConvertTo-SecureString 'jaGd,CC|0CR]TeeA~u-Q' -AsPlainText -Force) -Force\"", "delta": "0:00:02.531170", "end": "2025-05-01 05:06:05.210264", "msg": "non-zero return code", "rc": 1, "start": "2025-05-01 05:06:02.679094", "stderr": "Install-ADDSForest : Verification of prerequisites for Domain Controller promotion failed. The specified argument 'NewD\r\nomain' was not recognized.\r\nAt line:1 char:1\r\n+ Install-ADDSForest -DomainName example.local -SafeModeAdministratorPa ...\r\n+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n    + CategoryInfo          : NotSpecified: (:) [Install-ADDSForest], TestFailedException\r\n    + FullyQualifiedErrorId : Test.VerifyDcPromoCore.DCPromo.General.77,Microsoft.DirectoryServices.Deployment.PowerSh \r\n   ell.Commands.InstallADDSForestCommand\r\n", "stderr_lines": ["Install-ADDSForest : Verification of prerequisites for Domain Controller promotion failed. The specified argument 'NewD", "omain' was not recognized.", "At line:1 char:1", "+ Install-ADDSForest -DomainName example.local -SafeModeAdministratorPa ...", "+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~", "    + CategoryInfo          : NotSpecified: (:) [Install-ADDSForest], TestFailedException", "    + FullyQualifiedErrorId : Test.VerifyDcPromoCore.DCPromo.General.77,Microsoft.DirectoryServices.Deployment.PowerSh ", "   ell.Commands.InstallADDSForestCommand"], "stdout": "\r\nMessage                                                                                                                \r\n-------                                                                                                                \r\nVerification of prerequisites for Domain Controller promotion failed. The specified argument 'NewDomain' was not rec...\r\n\r\n\r\n", "stdout_lines": ["", "Message                                                                                                                ", "-------                                                                                                                ", "Verification of prerequisites for Domain Controller promotion failed. The specified argument 'NewDomain' was not rec...", "", ""]}

PLAY RECAP *************************************************************************************************************
74.176.136.13              : ok=32   changed=24   unreachable=0    failed=1    skipped=5    rescued=0    ignored=0


real    16m12.307s
user    0m18.669s
sys     0m6.422s
make: *** [../use-in-common.mk:18: apply] Error 2

yashirot · 2025-05-01T05:21:41Z

The specified argument 'NewD\r\nomain' was not recognized.

Seemingly an unintentional \r\n is inserted.

piroor requested a review from yashirot February 10, 2025 05:23

yashirot reviewed Feb 18, 2025

View reviewed changes

piroor added 3 commits April 30, 2025 10:43

Wait after reboot

b94a28f

Add tasks to setup Windows Server as an AD DC

723520a

Use wait_for_connection

33e5692

piroor force-pushed the setup-windows-server-as-ad-dc branch from a3b9813 to 33e5692 Compare April 30, 2025 01:46

Install .NET Framework after AD DC promotion

d8907bc

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Setup windows server as ad dc #56

Setup windows server as ad dc #56

Uh oh!

piroor commented Feb 10, 2025

Uh oh!

yashirot commented Feb 10, 2025

Uh oh!

yashirot commented Feb 10, 2025

Uh oh!

yashirot commented Feb 10, 2025

Uh oh!

yashirot left a comment

Uh oh!

piroor commented Apr 28, 2025

Uh oh!

yashirot commented Apr 28, 2025

Uh oh!

yashirot commented Apr 28, 2025 •

edited

Loading

Uh oh!

yashirot commented Apr 28, 2025

Uh oh!

yashirot commented Apr 28, 2025 •

edited

Loading

Uh oh!

piroor commented Apr 30, 2025

Uh oh!

piroor commented Apr 30, 2025

Uh oh!

piroor commented Apr 30, 2025

Uh oh!

yashirot commented May 1, 2025

Uh oh!

yashirot commented May 1, 2025

Uh oh!

Uh oh!

Setup windows server as ad dc #56

Are you sure you want to change the base?

Setup windows server as ad dc #56

Uh oh!

Conversation

piroor commented Feb 10, 2025

Uh oh!

yashirot commented Feb 10, 2025

Uh oh!

yashirot commented Feb 10, 2025

Uh oh!

yashirot commented Feb 10, 2025

Uh oh!

yashirot left a comment

Choose a reason for hiding this comment

Uh oh!

piroor commented Apr 28, 2025

Uh oh!

yashirot commented Apr 28, 2025

Uh oh!

yashirot commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yashirot commented Apr 28, 2025

Uh oh!

yashirot commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

piroor commented Apr 30, 2025

Uh oh!

piroor commented Apr 30, 2025

Uh oh!

piroor commented Apr 30, 2025

Uh oh!

yashirot commented May 1, 2025

Uh oh!

yashirot commented May 1, 2025

Uh oh!

Uh oh!

yashirot commented Apr 28, 2025 •

edited

Loading

yashirot commented Apr 28, 2025 •

edited

Loading