Capabilities
Active Directory
Feature
Playbook / Role
Type
Status
Notes
Create AD OU tree
playbooks/create-ad-ous.yml
build
dev
Derives per-application server OUs from inventory; on AADDS also links the AADDC Computers GPO to OU=Servers — see the usage guide
Create AD Users and Groups
playbooks/provision-ad.yml
build
dev
Create AD gMSAs and security groups
playbooks/create-gmsa.yml
build
dev
Purges Kerberos ticket caches on member hosts so new group membership applies without a reboot — see the gMSA usage guide
Create AD service accounts
playbooks/create-ad-users.yml
build
dev
Plain domain users from the desired-state ad_service_accounts, e.g. the System Pulse LDAP bind account — see the usage guide
Move computer objects into their target OU
playbooks/ensure-computer-ou.yml
maintenance
dev
Domain join only honors the OU when it creates the account; rebuilt VMs reuse the old object wherever it sits
Remove computer from AD
playbooks/remove-computer-ad.yml
maintenance
dev
-e computers=; the computers being removed do not need to be reachable or in the play
Windows
Feature
Playbook / Role
Type
Status
Notes
Provision AWS storage
aws_windows_storage build
prod
Provision Azure storage
azure_windows_storage build
prod
Install Microsoft SQL
microsoft_sql build
prod
Install Kuiper
kuiper build
prod
--tags install
Configure Kuiper
kuiper build
dev
--tags configure; instance settings via the Kuiper REST API (credentials, LDAP, environments, package sources, System Pulse) — see API Configuration
Manage Kuiper fleet
kuiper build
dev
--tags fleet (or machines/groups/certificates); machine registration, group membership, certificate import and deploy/bind
Install System Pulse
system_pulse build
prod
Fully headless (no Config Editor GUI); Azure SQL databases supported (dev)
Install Cogito and Caboodle
cogito build
prod
Install windows_exporter
windows_exporter build
prod
Used with Prometheus monitoring
CIS Hardening
trippsc2.cis.windows2022 build
dev
See playbooks/apply-windows-server-2022-cis-hardening.yml for recommended exclusions
Domain join
domain_join build
dev
playbooks/windows-join-domain.yml; places the computer object in the host's computer_ou
Log off disconnected sessions
playbooks/logoff-disconnected-sessions.yml
maintenance
prod
Useful for account lockouts after a password change
Epic ECSA
Epic Client Systems baseline settings for Windows servers, applied by the epic_ecsa role. Every section is opt-in via group_vars, so any tag is safe to run fleet-wide — see the usage guide .
Feature
Playbook / Role
Type
Status
Notes
Microsoft Defender exclusions
epic_ecsa build
dev
--tags defender; additive, sourced from the Epic Galaxy antivirus and per-server-type Server Setup documents
IIS request/query limits
epic_ecsa build
dev
--tags iis_limits; per-site upload and query-string limits (missing query limits cause intermittent OIDC failures on Interconnect)
ECF-over-TLS prerequisites
epic_ecsa build
dev
--tags ecf_tls; CAPI2 Operational log and SchUseStrongCrypto in both .NET hives
Microsoft Update registration
epic_ecsa build
dev
--tags ms_update; enables .NET updates via Microsoft Update
IIS log cleanup
epic_ecsa maintenance
dev
--tags iis_logs; daily scheduled task deleting aged IIS logs
Windows Server hardening baseline
epic_ecsa build
dev
--tags hardening; implements Epic's Server2022Hardening document with native idempotent modules
Edge favorites and desktop shortcuts
epic_ecsa build
dev
--tags edge_shortcuts; all-users desktop shortcuts, Edge favorites-bar folder, and New Tab Page tiles for the Epic web apps
Linux
Feature
Playbook / Role
Type
Status
Notes
Provision AWS storage
aws_linux_storage build
prod
Provision Azure storage
azure_linux_storage build
prod
Configure known_hosts
iris build
prod
--tags known_hosts
Configure /etc/hosts
iris build
prod
--tags hosts
Create local users (GIDs/UIDs)
iris build
prod
--tags users
Configure authorized_keys
iris build
prod
--tags keys
Configure sudoers
iris build
prod
--tags sudo
Configure search suffix
linux-system-roles.network build
dev
playbooks/configure-linux-search-suffix.yml
Domain Join
domain_join build
prod
playbooks/linux-join-domain.yml
Install Perimeter Auth (nginx)
perimeter_auth build
dev
playbooks/deploy-perimeter-auth.yml — see the usage guide
Manage firewalld zones
firewalld build
dev
Declarative zone XML management; zones not in firewalld_zones are removed — see the usage guide
Install and configure tuned/hugepages
iris build
prod
--tags tuned|hugepages
Install Iris
iris build
prod
--tags iris
Register with Satellite
subscription-manager build
dev
playbooks/register-with-satellite.yml
Install node_exporter
linux-exporter build
dev
playbooks/deploy-node_exporter.yml
Generic
Feature
Playbook / Role
Type
Status
Notes
Certificate Authority (PKI)
certificate_authority build
dev
Ansible internal CA or Microsoft AD CS signing back-ends; Windows and Linux targets — see the usage guide