version 3.3

patch-dc-controllers.yaml

@@ -1,33 +1,29 @@
 ---
-- name: Patch DCs via JEA (minimal allowed cmdlets)
+- name: Patch DCs via JEA 
   hosts: domain_controllers
   gather_facts: no
 
   tasks:
     - name: List available updates
       ansible.windows.win_powershell:
-        script: |
+        Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -IgnoreReboot
-          Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -IgnoreReboot
       register: available_updates
       changed_when: false
 
-    - name: Install updates (no reboot yet)
+    - name: Install updates
       ansible.windows.win_powershell:
-        script: |
+        Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -IgnoreReboot -Verbose
-          Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -IgnoreReboot -Verbose
       register: install_result
 
     - name: Reboot if required
       ansible.windows.win_powershell:
-        script: |
+        Restart-Computer -Force
-          Restart-Computer -Force
       async: 1
       poll: 0
 
     - name: Check update history
       ansible.windows.win_powershell:
-        script: |
+        Get-WUHistory | Select-Object -First 5
-          Get-WUHistory | Select-Object -First 5
       register: wu_history
       changed_when: false