Adding windows client to Ansible Inventory manually (WinRM)¶

# Enable WinRM service
Enable-PSRemoting -Force

# Set WinRM service to auto-start
Set-Service WinRM -StartupType Automatic
Start-Service WinRM

# Verify
winrm quickconfig

# Allow unencrypted (HTTP) — only for testing
winrm set winrm/config/service '@{AllowUnencrypted="true"}'

# Enable basic auth
winrm set winrm/config/service/auth '@{Basic="true"}'

# Increase memory per shell (critical for large tasks)
winrm set winrm/config/winrs '@{MaxMemoryPerShellMB="1024"}'

# Increase max envelope size
winrm set winrm/config '@{MaxEnvelopeSizekb="500"}'

# Set max concurrent operations
winrm set winrm/config/service '@{MaxConcurrentOperationsPerUser="50"}'

# Allow WinRM HTTP (5985) — only if needed
New-NetFirewallRule -Name "WinRM-HTTP" -DisplayName "WinRM HTTP" -Enabled True -Direction Inbound -Protocol TCP -LocalPort 5985 -Action Allow

# Create self-signed certificate
$cert = New-SelfSignedCertificate -DnsName "$env:COMPUTERNAME" -CertStoreLocation Cert:\LocalMachine\My

# Create HTTPS listener
winrm create winrm/config/Listener?Address=*+Transport=HTTPS "@{Hostname=`"$env:COMPUTERNAME`";CertificateThumbprint=`"$($cert.Thumbprint)`"}"

# Verify listeners
winrm enumerate winrm/config/listener

# Allow WinRM HTTPS (5986)
New-NetFirewallRule -Name "WinRM-HTTPS" -DisplayName "WinRM HTTPS" -Enabled True -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow

# Enable LocalAccountTokenFilterPolicy
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "LocalAccountTokenFilterPolicy" -Value 1 -Type DWord