mail_servers.yml

# Playbook to configure all Exchange 2019 mail servers
# Written by: Hani Audah <ht.aramco@gmail.com>
# Created on: Jun/04/2020
# -------------------------------------------------------------------------------------------------
- import_playbook: allocate_host_variables.yml

- hosts: mail_servers:mail_edge_servers:mail_witness_servers
  name: Join Exchange Servers to Domain
  vars_files:
    - "{{ playbook_dir }}/vault.yml"
    - "{{ playbook_dir }}/strings.yml"
    - "{{ playbook_dir }}/customizations.yml"
  vars:
    ansible_connection: winrm
    ansible_user: Administrator
    ansible_password: "{{ win_local_password }}"
    ansible_winrm_transport: ntlm
    ansible_port: 5985
  tasks:
    - include_tasks: join_domain.yml
      vars:
        machine_ou: "{{ exchange_ou }}"

- hosts: mail_servers:mail_edge_servers
  name: Deploy Exchange Servers
  vars_files:
    - "{{ playbook_dir }}/vault.yml"
    - "{{ playbook_dir }}/strings.yml"
    - "{{ playbook_dir }}/customizations.yml"
  vars:
    ansible_connection: winrm
    ansible_user: Administrator@{{ domain_name }}
    ansible_password: "{{ domain_admin_password }}"
    ansible_winrm_transport: credssp
    ansible_port: 5985
  tasks:
    - name: Install RSAT tools to allow for PrepareAD
      win_feature:
        name: RSAT-ADDS-Tools
        state: present

    - name: Install RSAT PowerShell module to check if schema was already extended
      win_feature:
        name: RSAT-AD-PowerShell
        state: present

    - name: Get Exchange 2019 installation disc drive letter
      win_shell: Get-CimInstance Win32_LogicalDisk | ?{ $_.DriveType -eq 5 -and $_.VolumeName -eq 'EXCHANGESERVER2019-X64' } | % {$_.DeviceID}
      register: drive_output

    - name: Check if Active Directory already prepared
      win_shell: |
        $schemaPath = (Get-ADRootDSE).schemaNamingContext
        $match = Get-ADObject -Filter 'Name -eq "ms-Exch-Schema-Version-Pt"' -SearchBase $schemaPath -Properties lDAPDisplayName
        if ($match -ne $null) { return "Schema Extended" }
      register: schema_extended

    - name: Run schema extension command
      win_shell: setup.exe /IAcceptExchangeServerLicenseTerms /PrepareAD /OrganizationName:{{ orgname }}
      args:
        chdir: "{{ drive_output.stdout | trim }}"
        executable: cmd
      when: "'Schema Extended' not in schema_extended.stdout"
      run_once: yes

    - name: Create folder for prerequisite installers
      win_file:
        path: C:\Installers
        state: directory

    - name: Copy prerequisite installers
      win_copy:
        src: \\{{ domain_name }}\Shares\domain\{{ item }}
        dest: C:\Installers\{{ item }}
        remote_src: yes
      loop:
        - UcmaRuntimeSetup.exe
        - vcredist_x64.exe

    - name: Install Unified Communications prerequisite
      win_package:
        path: C:\Installers\UcmaRuntimeSetup.exe
        product_id: '{A41CBE7D-949C-41DD-9869-ABBD99D753DA}'
        arguments: /quiet /norestart
        state: present

    - name: Install Visual C++ prerequisite
      win_package:
        path: C:\Installers\vcredist_x64.exe
        product_id: '{929FBD26-9020-399B-9A7A-751D61F0B942}'
        arguments: /install /quiet /norestart
        state: present

    - name: Install Exchange 2019 Mailbox Server from mounted ISO
      win_package:
        path: "{{ drive_output.stdout | trim }}\\setup.exe"
        product_id: 'Microsoft Exchange v15'
        arguments: /IAcceptExchangeServerLicenseTerms /Mode:Install /Roles:Mailbox /InstallWindowsComponents
        state: present
      when: "'mail_edge_servers' not in group_names"

    - name: Install Exchange 2019 Edge Transport Server from mounted ISO
      win_package:
        path: "{{ drive_output.stdout | trim }}\\setup.exe"
        product_id: 'Microsoft Exchange v15'
        arguments: /IAcceptExchangeServerLicenseTerms /Mode:Install /Roles:EdgeTransport /InstallWindowsComponents
        state: present
      when: "'mail_edge_servers' in group_names"

    - name: Install DSC module for Exchange Powershell management
      win_psmodule:
        name: xExchange
        state: present

- hosts: mail_witness_servers
  name: Configure Exchange Witness servers
  vars_files:
    - "{{ playbook_dir }}/vault.yml"
    - "{{ playbook_dir }}/strings.yml"
    - "{{ playbook_dir }}/customizations.yml"
  vars:
    ansible_connection: winrm
    ansible_user: Administrator@{{ domain_name }}
    ansible_password: "{{ domain_admin_password }}"
    ansible_winrm_transport: credssp
    ansible_port: 5985
  tasks:
    - win_firewall_rule:
        name: WMI ASync-In
        direction: in
        protocol: tcp
        program: "%systemroot%\\system32\\wbem\\unsecapp.exe"
        profiles: domain
    - win_firewall_rule:
        name: WMI DCOM-In
        direction: in
        protocol: tcp
        localport: 135
        program: "%systemroot%\\system32\\svchost.exe"
        profiles: domain
    - win_firewall_rule:
        name: WMI-In
        direction: in
        protocol: tcp
        program: "%systemroot%\\system32\\svchost.exe"
        service: winmgmt
        profiles: domain
    - win_firewall_rule:
        name: WMI-Out
        direction: out
        protocol: tcp
        program: "%systemroot%\\system32\\svchost.exe"
        service: winmgmt
        profiles: domain

    - name: Add Exchange Trusted Subsystem to local admin group
      win_group_membership:
        name: Administrators
        members:
          - Exchange Trusted Subsystem@{{ domain_name }}
        state: present

- hosts: mail_servers
  name: Configure Exchange Mailbox servers
  vars_files:
    - "{{ playbook_dir }}/vault.yml"
    - "{{ playbook_dir }}/strings.yml"
    - "{{ playbook_dir }}/customizations.yml"
  vars:
    ansible_connection: winrm
    ansible_user: Administrator@{{ domain_name }}
    ansible_password: "{{ domain_admin_password }}"
    ansible_winrm_transport: credssp
    ansible_port: 5985
  tasks:
    - name: Install Failover Clustering feature to join DAGs
      win_feature:
        name: Failover-Clustering
        state: present
      register: cluster_feature

    - name: Reboot after Failover Clustering feature installation
      win_reboot:
      when: cluster_feature.reboot_required

    - name: Create Internet send connector
      win_dsc:
        resource_name: xExchSendConnector
        Name: 'Internet Send Connector'
        Ensure: Present
        Usage: Internet
        DnsRoutingEnabled: yes
        AddressSpaces:
          - '*'
        SourceTransportServers: "{{ groups['mail_servers'] }}"
        Credential_username: "Administrator@{{ domain_name }}"
        Credential_password: "{{ domain_admin_password }}"

    - name: Configure ECP virtual directory
      win_dsc:
        resource_name: xExchEcpVirtualDirectory
        Identity: "{{ inventory_hostname }}\\ecp (Default Web Site)"
        ExternalUrl: https://mail.{{ domain_name }}/ecp
        InternalUrl: https://mail.{{ domain_name }}/ecp
        AllowServiceRestart: yes
        Credential_username: "Administrator@{{ domain_name }}"
        Credential_password: "{{ domain_admin_password }}"

    - name: Configure MAPI virtual directory
      win_dsc:
        resource_name: xExchMapiVirtualDirectory
        Identity: "{{ inventory_hostname }}\\mapi (Default Web Site)"
        ExternalUrl: https://mail.{{ domain_name }}/mapi
        InternalUrl: https://mail.{{ domain_name }}/mapi
        IISAuthenticationMethods:
          - 'NTLM'
        AllowServiceRestart: yes
        Credential_username: "Administrator@{{ domain_name }}"
        Credential_password: "{{ domain_admin_password }}"

    - name: Configure OAB virtual directory
      win_dsc:
        resource_name: xExchOabVirtualDirectory
        Identity: "{{ inventory_hostname }}\\OAB (Default Web Site)"
        ExternalUrl: https://mail.{{ domain_name }}/oab
        InternalUrl: https://mail.{{ domain_name }}/oab
        AllowServiceRestart: yes
        Credential_username: "Administrator@{{ domain_name }}"
        Credential_password: "{{ domain_admin_password }}"

    - name: Configure Outlook Anywhere URL
      win_dsc:
        resource_name: xExchOutlookAnywhere
        Identity: "{{ inventory_hostname }}\\Rpc (Default Web Site)"
        ExternalClientsRequireSSL: yes
        InternalClientsRequireSSL: yes
        ExternalHostName: mail.{{ domain_name }}
        InternalHostName: mail.{{ domain_name }}
        IISAuthenticationMethods: Ntlm
        InternalClientAuthenticationMethod: Ntlm
        ExternalClientAuthenticationMethod: Ntlm
        AllowServiceRestart: yes
        Credential_username: "Administrator@{{ domain_name }}"
        Credential_password: "{{ domain_admin_password }}"

    - name: Configure OWA virtual directory
      win_dsc:
        resource_name: xExchOwaVirtualDirectory
        Identity: "{{ inventory_hostname }}\\owa (Default Web Site)"
        BasicAuthentication: yes
        FormsAuthentication: yes
        WindowsAuthentication: yes
        ExternalAuthenticationMethods:
          - 'Fba'
        ExternalUrl: https://mail.{{ domain_name }}/owa
        InternalUrl: https://mail.{{ domain_name }}/owa
        AllowServiceRestart: yes
        Credential_username: "Administrator@{{ domain_name }}"
        Credential_password: "{{ domain_admin_password }}"

    - name: Configure EWS virtual directory
      win_dsc:
        resource_name: xExchWebServicesVirtualDirectory
        Identity: "{{ inventory_hostname }}\\EWS (Default Web Site)"
        ExternalUrl: https://mail.{{ domain_name }}/ews/exchange.asmx
        InternalUrl: https://mail.{{ domain_name }}/ews/exchange.asmx
        AllowServiceRestart: yes
        Credential_username: "Administrator@{{ domain_name }}"
        Credential_password: "{{ domain_admin_password }}"

    - name: Create the DAG
      win_dsc:
        resource_name: xExchDatabaseAvailabilityGroup
        Name: PrimaryDAG
        AutoDagTotalNumberOfServers: "{{ groups['mail_servers'] | length }}"
        AutoDagDatabaseCopiesPerVolume: 1
        AutoDagDatabasesRootFolderPath: C:\ExchangeDatabases
        AutoDagVolumesRootFolderPath: C:\ExchangeVolumes
        DatacenterActivationMode: DagOnly
        SkipDagValidation: yes
        WitnessServer: "{{ groups['mail_witness_servers'] | random }}"
        WitnessDirectory: C:\ExchangeWitness
        Credential_username: "Administrator@{{ domain_name }}"
        Credential_password: "{{ domain_admin_password }}"
      run_once: yes

    - name: Wait for DAG creation to complete
      win_dsc:
        resource_name: xExchWaitForDAG
        Identity: PrimaryDAG
        Credential_username: "Administrator@{{ domain_name }}"
        Credential_password: "{{ domain_admin_password }}"

    - name: Add server to DAG
      win_dsc:
        resource_name: xExchDatabaseAvailabilityGroupMember
        MailboxServer: "{{ inventory_hostname }}"
        DAGName: PrimaryDAG
        Credential_username: "Administrator@{{ domain_name }}"
        Credential_password: "{{ domain_admin_password }}"