Connect securely to Windows hosts

[windows]
winserver.example.com ansible_host=192.168.1.10

[windows:vars]
ansible_user=AnsibleUser@EXAMPLE.COM
ansible_password={{ vault_win_password }}
ansible_connection=psrp
ansible_psrp_port=5986
ansible_psrp_auth=kerberos
ansible_psrp_kerberos_delegation=true
ansible_psrp_cert_validation=validate
ansible_psrp_ca_cert=/etc/pki/ca-trust/source/anchors/internal_corporate_ca.pem

 New-ItemProperty `
      -Path "HKLM:\SOFTWARE\OpenSSH" `
      -Name "DefaultShell" `
      -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" `
      -PropertyType String `
      -Force

[windows_ssh]
winserver.example.com

[windows_ssh:vars]
ansible_connection=ssh
ansible_shell_type=cmd
ansible_user=Administrator

<#
.SYNOPSIS
    Production-Hardened OpenSSH Provisioning Script for Windows Targets.
    Compatible with Windows Server 2019, 2022, and 2025.
#>
$ErrorActionPreference = "Stop"

# ==============================================================================
# 1. Enforce Administrator Elevation Access Layer
# ==============================================================================
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object Security.Principal.WindowsPrincipal($identity)
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Error "Execution Halted: This script must be executed within an Elevated Administrator context."
    Exit 1
}

# ==============================================================================
# 2. Unified Windows Capability Onboarding (Server 2019 - 2025)
# ==============================================================================
Write-Host "Evaluating Component-Based Servicing state for OpenSSH..." -ForegroundColor Cyan
$capability = Get-WindowsCapability -Online -Name "OpenSSH.Server*"

if ($capability.State -ne 'Installed') {
    Write-Host "Target missing capability. Provisioning via Active OS Deployment Engine..." -ForegroundColor Yellow
    Add-WindowsCapability -Online -Name $capability.Name
} else {
    Write-Host "OpenSSH Server capability confirmed active." -ForegroundColor Green
}

# ==============================================================================
# 3. Configure Daemon Service State Machine
# ==============================================================================
Write-Host "Configuring service operational thresholds..." -ForegroundColor Cyan
Set-Service -Name sshd -StartupType 'Automatic'
if ((Get-Service -Name sshd).Status -ne 'Running') {
    Start-Service sshd
}

# ==============================================================================
# 4. Assertive Firewall Enforcement
# ==============================================================================
Write-Host "Validating Security Edge Boundaries..." -ForegroundColor Cyan
$fwRule = Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue

if (-not $fwRule) {
    Write-Host "Inbound Rule missing. Applying clean Port 22 Profile..." -ForegroundColor Yellow
    New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True `
        -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow
} elseif ($fwRule.Enabled -ne 'True') {
    Write-Host "Inbound Rule exists but is suppressed. Overriding to Enabled status..." -ForegroundColor Yellow
    Set-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -Enabled True
} else {
    Write-Host "Firewall verification passed." -ForegroundColor Green
}

# ==============================================================================
# 5. Native 64-Bit Registry Overrides (Bypassing WoW64 Translation)
# ==============================================================================
Write-Host "Locking default command interpretation environment..." -ForegroundColor Cyan
$shellPath = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"

$hive = [Microsoft.Win32.RegistryHive]::LocalMachine
$view = [Microsoft.Win32.RegistryView]::Registry64
$baseKey = [Microsoft.Win32.RegistryKey]::OpenBaseKey($hive, $view)

$sshKey = $baseKey.CreateSubKey("SOFTWARE\OpenSSH")
$sshKey.SetValue("DefaultShell", $shellPath, [Microsoft.Win32.RegistryValueKind]::String)

$sshKey.Close()
$baseKey.Close()
Write-Host "Default shell environment set to native 64-bit PowerShell process architecture." -ForegroundColor Green

# ==============================================================================
# 6. Cryptographic ACL Normalization via Well-Known SIDs
# ==============================================================================
Write-Host "Hardening key storage access schemas..." -ForegroundColor Cyan
$adminKeyPath = "$env:ProgramData\ssh\administrators_authorized_keys"

if (-not (Test-Path $adminKeyPath)) {
    # Ensure parent directory is structured if service hasn't initialized disk footprints yet
    $null = New-Item -ItemType File -Path $adminKeyPath -Force
}

# Using Explicit SIDs (*S-1-5-32-544 = Builtin Administrators, *S-1-5-18 = Local System) 
# This preserves execution integrity across global internationalized operating systems.
icacls.exe $adminKeyPath /inheritance:r /grant "*S-1-5-32-544:F" /grant "*S-1-5-18:F"

Write-Host "OpenSSH configuration normalized. Target node is fully prepped for Ansible orchestration." -ForegroundColor Green

fields:
  - id: username
    type: string
    label: Domain Username
  - id: password
    type: string
    label: Domain Password
    secret: true
  - id: default_realm
    type: string
    label: Active Directory Realm (UPPERCASE)
  - id: kdc
    type: string
    label: Key Distribution Center (KDC Host/IP)
    help_text: Optional. Populate only if environment lacks working KDC DNS SRV lookups.
required:
  - username
  - password
  - default_realm

env:
  KRB5_CONFIG: '{{ tower.filename }}'
file:
  template: |-
    [libdefaults]
    default_realm = {{ default_realm | upper }}
    dns_canonicalize_hostname = fallback
    dns_lookup_kdc = {% if kdc %}false{% else %}true{% endif %}
    dns_lookup_realm = true
    forwardable = true
    rdns = false

    [realms]
    {{ default_realm | upper }} = {
        {% if kdc %}kdc = {{ kdc }}{% endif %}
    }

    [domain_realm]
    {{ default_realm | lower }} = {{ default_realm | upper }}
extra_vars:
  ansible_user: '{{ username }}'
  ansible_password: '{{ password }}

# Set encryption and authentication
ansible_psrp_auth: kerberos
ansible_psrp_message_encryption: always
# Forward Kerberos environment variables to the connection plugin:
ansible_psrp_env:
  - KRB5_CONFIG
  - KRB5_TRACE

ansible_winrm_transport: kerberos
ansible_winrm_message_encryption: always
ansible_winrm_kerberos_delegation: false  # change to true where needed
ansible_winrm_kinit_env_vars:
  - KRB5_CONFIG
  - KRB5_TRACE