first commit

roles/windows_onboard-mde/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/windows_onboard-mde/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for windows_onboard-mde

roles/windows_onboard-mde/files/WindowsDefenderATPLocalOnboardingScript.cmd

@@ -0,0 +1,188 @@
+@echo off
+
+echo This script is for onboarding machines to the Microsoft Defender for Endpoint services, including security and compliance products.
+echo Once completed, the machine should light up in the portal within 5-30 minutes, depending on this machine's Internet connectivity availability and machine power state (plugged in vs. battery powered).
+echo IMPORTANT: This script is optimized for onboarding a single machine and should not be used for large scale deployment.
+echo For more information on large scale deployment, please consult the MDE documentation (links available in the MDE portal under the endpoint onboarding section).
+echo.
+:USER_CONSENT
+::set /p shouldContinue= "Press (Y) to confirm and continue or (N) to cancel and exit: "
+set shouldContinue="Y"
+::IF /I "%shouldContinue%"=="N" (
+::	GOTO CLEANUP
+::)
+::IF /I "%shouldContinue%"=="Y" (
+	GOTO SCRIPT_START
+::)
+echo.
+echo Wrong input. Please try again.
+GOTO USER_CONSENT
+echo.
+:SCRIPT_START
+REG add "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /v latency /t REG_SZ /f /d "Demo" >NUL 2>&1
+
+@echo off
+
+echo.
+echo Starting Microsoft Defender for Endpoint onboarding process...
+echo.
+
+set errorCode=0
+set lastError=0
+set "troubleshootInfo=For more information, visit: https://go.microsoft.com/fwlink/p/?linkid=822807"
+set "errorDescription="
+
+echo Testing administrator privileges
+
+net session >NUL 2>&1
+if %ERRORLEVEL% NEQ 0 (
+	@echo Script is running with insufficient privileges. Please run with administrator privileges> %TMP%\senseTmp.txt
+	set errorCode=65
+ set lastError=%ERRORLEVEL%
+	GOTO ERROR
+)
+
+echo Script is running with sufficient privileges
+echo.
+echo Performing onboarding operations
+echo.
+
+IF [%PROCESSOR_ARCHITEW6432%] EQU [] (
+  set powershellPath=%windir%\System32\WindowsPowerShell\v1.0\powershell.exe
+) ELSE (
+  set powershellPath=%windir%\SysNative\WindowsPowerShell\v1.0\powershell.exe
+)
+
+set sdbin=0100048044000000540000000000000014000000020030000200000000001400FF0F120001010000000000051200000000001400E104120001010000000000050B0000000102000000000005200000002002000001020000000000052000000020020000 >NUL 2>&1
+reg add HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security /v 14f8138e-3b61-580b-544b-2609378ae460 /t REG_BINARY /d %sdbin% /f >NUL 2>&1
+reg add HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security /v cb2ff72d-d4e4-585d-33f9-f3a395c40be7 /t REG_BINARY /d %sdbin% /f >NUL 2>&1
+
+REG add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v DisableEnterpriseAuthProxy /t REG_DWORD /f /d 1 >NUL 2>&1
+
+%powershellPath% -ExecutionPolicy Bypass -NoProfile -Command "Add-Type ' using System; using System.IO; using System.Runtime.InteropServices; using Microsoft.Win32.SafeHandles; using System.ComponentModel; public static class Elam{ [DllImport(\"Kernel32\", CharSet=CharSet.Auto, SetLastError=true)] public static extern bool InstallELAMCertificateInfo(SafeFileHandle handle); public static void InstallWdBoot(string path) { Console.Out.WriteLine(\"About to call create file on {0}\", path); var stream = File.Open(path, FileMode.Open, FileAccess.Read, FileShare.Read); var handle = stream.SafeFileHandle; Console.Out.WriteLine(\"About to call InstallELAMCertificateInfo on handle {0}\", handle.DangerousGetHandle()); if (!InstallELAMCertificateInfo(handle)) { Console.Out.WriteLine(\"Call failed.\"); throw new Win32Exception(Marshal.GetLastWin32Error()); } Console.Out.WriteLine(\"Call successful.\"); } } '; $driverPath = $env:SystemRoot + '\System32\Drivers\WdBoot.sys'; [Elam]::InstallWdBoot($driverPath) " >NUL 2>&1
+
+REG query "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /v 696C1FA1-4030-4FA4-8713-FAF9B2EA7C0A /reg:64 > %TMP%\senseTmp.txt 2>&1
+if %ERRORLEVEL% EQU 0 (  
+    REG delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /v 696C1FA1-4030-4FA4-8713-FAF9B2EA7C0A /f > %TMP%\senseTmp.txt 2>&1
+    if %ERRORLEVEL% NEQ 0 (
+        set "errorDescription=Unable to delete previous offboarding information from registry."
+        set errorCode=5
+        set lastError=%ERRORLEVEL%
+        GOTO ERROR
+    )
+)
+
+REG add "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /v OnboardingInfo /t REG_SZ /f /d "{\"body\":\"{\\\"previousOrgIds\\\":[],\\\"orgId\\\":\\\"e2410533-3ed7-4855-86a0-91e4a7808621\\\",\\\"geoLocationUrl\\\":\\\"https://winatp-gw-weu.microsoft.com/\\\",\\\"datacenter\\\":\\\"WestEurope\\\",\\\"vortexGeoLocation\\\":\\\"EU\\\",\\\"version\\\":\\\"1.47\\\"}\",\"sig\":\"dgvoVHc7kpfFDdTYl5ngU7oJwaLcuRs93ErynM5svTaSfwSHvLPP+SFtyXE1VLO4XBh3Re7iMwwd09r0KyuM0xsLEvMAvSjepCYquxY481j1SfN3PHzYGkVFc68NXeISekeUmiAocKgQDp8dLWUW8L6JEunFEJOlIDsPuwhgYeDWUxzv71a21wfTocaEYhdJ0lrQoK2uxpuPUh2eVN9yY/oFaqce3PhPKiG/ZP6IlygRne9Bkyv0j95n7n8ny03g1iAr+PHjSbdcM90sn4Q/6ZLssEd9PXm6D9DkpuXs22qi1ghRAf2voXXz72UD6ezglmBaTfqeAeD94GHhgc/2Ow==\",\"sha256sig\":\"FYJhkIZxRBc+DFVvm+sf/4TCxKWIrZE6ovtNUhNnqOkuspd9r8fVnW7gtNx86mocusfKBrmKXNd3a4eh9x23y8+nK2thr+uGJ8Grge0fGdv6gnqF7gYXLNfCxAsnFIWL96FIf4LW8f9CxlCYoVm0P0Wo6fiY3aOi2QshJPPbmFGsWu0wgu/0Mlg9620vFcQBBUrpsJDOE+NuZD0rppjqGqe3F2XMKqfuKrvYcNEaIMcriLHG6RQ+EbBM31XQcIw8ImEdsMKCtn3PTgIWt8vAbtEK7fiCBG66F+Qtm89XzakJODNU+Ch/Cr97dRKquoU3dbbWEUb7zmjthQ4pRM4Xpg==\",\"cert\":\"MIIFgzCCA2ugAwIBAgITMwAAAgKh9Eww96dTKQAAAAACAjANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQgU2VjdXJlIFNlcnZlciBDQSAyMDExMB4XDTIzMDIyMzE5NDMxMVoXDTI0MDIyMzE5NDMxMVowHjEcMBoGA1UEAxMTU2V2aWxsZS5XaW5kb3dzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALjedJ4XjZjlasoG2AecXnOQ4T04l1VeqhjrfJ6PvQf1oiI8HuZ1l0l6Szgvl0yi2dehEL0llDAaqAjk/T5wFF6fYA4JfXriOTx83zsq9IKnjVZ34Jzbfkvy9lHTu+giCDkzs/Eo560rpJXl5VlGsQpzzYCkWZ6ZJQ1eDfrPqu3SISi+Na0cxE3nGpqG5mtMckdrsrzwrDuKm4qAQaGsGlfEoR1IVtCNydnuL+FmPK9+j/nzJ4eHqIzr8Euz3laW+UGvf2r7Z5n19IFT7sJuqjTeG5RC+LODHQFl/knG9sRQaae+zqkmPvMT7m4tx2/HJsyJsatOp38GJ3f+Qqy8/3UCAwEAAaOCAVgwggFUMA4GA1UdDwEB/wQEAwIFIDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAeBgNVHREEFzAVghNTZXZpbGxlLldpbmRvd3MuY29tMB0GA1UdDgQWBBSz+8TlAUJCn2MDTDONsD1p+meKaTAfBgNVHSMEGDAWgBQ2VollSctbmy88rEIWUE2RuTPXkTBTBgNVHR8ETDBKMEigRqBEhkJodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNTZWNTZXJDQTIwMTFfMjAxMS0xMC0xOC5jcmwwYAYIKwYBBQUHAQEEVDBSMFAGCCsGAQUFBzAChkRodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY1NlY1NlckNBMjAxMV8yMDExLTEwLTE4LmNydDANBgkqhkiG9w0BAQsFAAOCAgEAoKKuLorfzJWL6HsBsAMwocM295/IkS5FVTASKTdZsqF9Q0Dvngx5YRMY1ljznNhyUYLXzLFKom2oVHlUmhbgY0zVkK798Mv6MEscMxxiQ9o/s8DxxdCBmnwswg3ERR8Q6RCqclsp8LEGUmQXJiLA5EFZSNMa2qlHQS3LoaEz5saVTvt6UihfwclY/F5MJOtlj+IJyv3lIX5Gdzi5wlCp7gMhOZmwDh2RCvulWT3wMmyz2lNT/vkEb8IJ7oKr+/oj7wPTmCZ0k20wyDIa9QbVBMX0CiotY5RHkHZnzkpi4lWc6f2MXsqMRjP6iyyylWQ1Itn+rKjHeBuLAIfqQWuvfT1kyH5IM6QXQw8DS6Wto0hjIx9epUOPscxOr/Qli8zOYJ3i/h3j9/x41hArCnla/ISf5hDVPm0/LTDfFZWxuvMjjnkk+HmsEpq5oaV/Pmuh8ml47kXWddJrAJGDPtEZNqpjO+ObH0P7kb/t5feK1mTmSsKwMJVTnlIUuubbRM2ZeQ0kkZKSUhVjMvO6YfoR6f2EkrCXWlr9VPYtro+pAy4cVMARDW1aOPPLyxk/7cLL+YUTYbEOw+D+bQXEr00AsjmzucvRN2paejjBSH8A+8k+alPobReH88Ktlo4GkqbK9S3vSqH4zJC3GcIJ+mQBxcUlmKWbC5lRo9btWPcTEOU=\",\"chain\":[\"MIIG2DCCBMCgAwIBAgIKYT+3GAAAAAAABDANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTEwHhcNMTExMDE4MjI1NTE5WhcNMjYxMDE4MjMwNTE5WjB+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQgU2VjdXJlIFNlcnZlciBDQSAyMDExMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0AvApKgZgeI25eKq5fOyFVh1vrTlSfHghPm7DWTvhcGBVbjz5/FtQFU9zotq0YST9XV8W6TUdBDKMvMj067uz54EWMLZR8vRfABBSHEbAWcXGK/G/nMDfuTvQ5zvAXEqH4EmQ3eYVFdznVUr8J6OfQYOrBtU8yb3+CMIIoueBh03OP1y0srlY8GaWn2ybbNSqW7prrX8izb5nvr2HFgbl1alEeW3Utu76fBUv7T/LGy4XSbOoArX35Ptf92s8SxzGtkZN1W63SJ4jqHUmwn4ByIxcbCUruCw5yZEV5CBlxXOYexl4kvxhVIWMvi1eKp+zU3sgyGkqJu+mmoE4KMczVYYbP1rL0I+4jfycqvQeHNye97sAFjlITCjCDqZ75/D93oWlmW1w4Gv9DlwSa/2qfZqADj5tAgZ4Bo1pVZ2Il9q8mmuPq1YRk24VPaJQUQecrG8EidT0sH/ss1QmB619Lu2woI52awb8jsnhGqwxiYL1zoQ57PbfNNWrFNMC/o7MTd02Fkr+QB5GQZ7/RwdQtRBDS8FDtVrSSP/z834eoLP2jwt3+jYEgQYuh6Id7iYHxAHu8gFfgsJv2vd405bsPnHhKY7ykyfW2Ip98eiqJWIcCzlwT88UiNPQJrDMYWDL78p8R1QjyGWB87v8oDCRH2bYu8vw3eJq0VNUz4CedMCAwEAAaOCAUswggFHMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBQ2VollSctbmy88rEIWUE2RuTPXkTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBDuRQFTuHqp8cx0SOJNDBaBgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3JsMF4GCCsGAQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3J0MA0GCSqGSIb3DQEBCwUAA4ICAQBByGHB9VuePpEx8bDGvwkBtJ22kHTXCdumLg2fyOd2NEavB2CJTIGzPNX0EjV1wnOl9U2EjMukXa+/kvYXCFdClXJlBXZ5re7RurguVKNRB6xo6yEM4yWBws0q8sP/z8K9SRiax/CExfkUvGuV5Zbvs0LSU9VKoBLErhJ2UwlWDp3306ZJiFDyiiyXIKK+TnjvBWW3S6EWiN4xxwhCJHyke56dvGAAXmKX45P8p/5beyXf5FN/S77mPvDbAXlCHG6FbH22RDD7pTeSk7Kl7iCtP1PVyfQoa1fB+B1qt1YqtieBHKYtn+f00DGDl6gqtqLine truncated
+if %ERRORLEVEL% NEQ 0 (
+   set "errorDescription=Unable to write onboarding information to registry."
+   set errorCode=10
+   set lastError=%ERRORLEVEL%
+   GOTO ERROR
+)
+
+echo Starting the service, if not already running
+echo.
+sc query "SENSE" | find /i "RUNNING" >NUL 2>&1
+if %ERRORLEVEL% EQU 0 GOTO RUNNING
+
+net start sense > %TMP%\senseTmp.txt 2>&1
+if %ERRORLEVEL% NEQ 0 (
+   echo Microsoft Defender for Endpoint Service has not started yet
+   GOTO WAIT_FOR_THE_SERVICE_TO_START
+)
+goto SUCCEEDED
+
+:RUNNING
+set "runningOutput=The Microsoft Defender for Endpoint Service is already running!"
+echo %runningOutput%
+echo.
+eventcreate /l Application /so WDATPOnboarding /t Information /id 10 /d "%runningOutput%" >NUL 2>&1
+GOTO WAIT_FOR_THE_SERVICE_TO_START
+
+:ERROR
+Set /P errorMsg=<%TMP%\senseTmp.txt
+set "errorOutput=[Error Id: %errorCode%, Error Level: %lastError%] %errorDescription% Error message: %errorMsg%"
+%powershellPath% -ExecutionPolicy Bypass -NoProfile -Command "Add-Type 'using System; using System.Diagnostics; using System.Diagnostics.Tracing; namespace Sense { [EventData(Name = \"Onboarding\")]public struct Onboarding{public string Message { get; set; }} public class Trace {public static EventSourceOptions TelemetryCriticalOption = new EventSourceOptions(){Level = EventLevel.Error, Keywords = (EventKeywords)0x0000200000000000, Tags = (EventTags)0x0200000}; public void WriteOnboardingMessage(string message){es.Write(\"OnboardingScript\", TelemetryCriticalOption, new Onboarding {Message = message});} private static readonly string[] telemetryTraits = { \"ETW_GROUP\", \"{5ECB0BAC-B930-47F5-A8A4-E8253529EDB7}\" }; private EventSource es = new EventSource(\"Microsoft.Windows.Sense.Client.Management\",EventSourceSettings.EtwSelfDescribingEventFormat,telemetryTraits);}}'; $logger = New-Object -TypeName Sense.Trace; $logger.WriteOnboardingMessage('%errorOutput%')" >NUL 2>&1
+echo %errorOutput%
+echo %troubleshootInfo%
+echo.
+eventcreate /l Application /so WDATPOnboarding /t Error /id %errorCode% /d "%errorOutput%" >NUL 2>&1
+GOTO CLEANUP
+
+:SUCCEEDED
+echo Finished performing onboarding operations
+echo.
+GOTO WAIT_FOR_THE_SERVICE_TO_START
+
+:WAIT_FOR_THE_SERVICE_TO_START
+echo Waiting for the service to start
+echo.
+
+set /a counter=0
+
+:SENSE_RUNNING_WAIT
+sc query "SENSE" | find /i "RUNNING" >NUL 2>&1
+if %ERRORLEVEL% NEQ 0 (
+	IF %counter% EQU 4 (
+		set "errorDescription=Unable to start Microsoft Defender for Endpoint Service."
+		set errorCode=15
+		set lastError=%ERRORLEVEL%
+		GOTO ERROR
+	)
+
+	set /a counter=%counter%+1
+
+	timeout 5 >NUL 2>&1
+	GOTO :SENSE_RUNNING_WAIT
+)
+
+set /a counter=0
+
+:SENSE_ONBOARDED_STATUS_WAIT
+REG query "HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status" /v OnboardingState /reg:64 >NUL 2>&1
+if %ERRORLEVEL% NEQ 0 (
+	IF %counter% EQU 4 (
+		@echo Microsoft Defender for Endpoint Service is not running as expected> %TMP%\senseTmp.txt
+		set errorCode=35
+     set lastError=%ERRORLEVEL%
+		GOTO ERROR
+	)
+
+	set /a counter=%counter%+1
+
+	timeout 5 >NUL 2>&1
+	GOTO :SENSE_ONBOARDED_STATUS_WAIT
+)
+
+set /a counter=0
+
+:SENSE_ONBOARDED_WAIT
+REG query "HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status" /v OnboardingState /reg:64 | find /i "0x1" >NUL 2>&1
+if %ERRORLEVEL% NEQ 0 (
+	IF %counter% EQU 4 (
+		@echo Microsoft Defender for Endpoint Service is not running as expected> %TMP%\senseTmp.txt
+		set errorCode=40
+     set lastError=%ERRORLEVEL%
+		GOTO ERROR
+	)
+
+	set /a counter=%counter%+1
+
+	timeout 5 >NUL 2>&1
+	GOTO :SENSE_ONBOARDED_WAIT
+)
+
+set "successOutput=Successfully onboarded machine to Microsoft Defender for Endpoint"
+echo %successOutput%
+echo.
+eventcreate /l Application /so WDATPOnboarding /t Information /id 20 /d "%successOutput%" >NUL 2>&1
+%powershellPath% -ExecutionPolicy Bypass -NoProfile -Command "Add-Type 'using System; using System.Diagnostics; using System.Diagnostics.Tracing; namespace Sense { [EventData(Name = \"Onboarding\")]public struct Onboarding{public string Message { get; set; }} public class Trace {public static EventSourceOptions TelemetryCriticalOption = new EventSourceOptions(){Level = EventLevel.Informational, Keywords = (EventKeywords)0x0000200000000000, Tags = (EventTags)0x0200000}; public void WriteOnboardingMessage(string message){es.Write(\"OnboardingScript\", TelemetryCriticalOption, new Onboarding {Message = message});} private static readonly string[] telemetryTraits = { \"ETW_GROUP\", \"{5ECB0BAC-B930-47F5-A8A4-E8253529EDB7}\" }; private EventSource es = new EventSource(\"Microsoft.Windows.Sense.Client.Management\",EventSourceSettings.EtwSelfDescribingEventFormat,telemetryTraits);}}'; $logger = New-Object -TypeName Sense.Trace; $logger.WriteOnboardingMessage('%successOutput%')" >NUL 2>&1
+"%PROGRAMFILES%\Windows Defender\MpCmdRun.exe" -ReloadEngine >NUL 2>&1
+
+GOTO CLEANUP
+
+:CLEANUP
+if exist %TMP%\senseTmp.txt del %TMP%\senseTmp.txt
+pause
+EXIT /B %errorCode%
+

roles/windows_onboard-mde/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for windows_onboard-mde

roles/windows_onboard-mde/meta/main.yml

@@ -0,0 +1,52 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.1
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

roles/windows_onboard-mde/tasks/main.yml

@@ -0,0 +1,11 @@
+---
+# tasks file for windows_onboard-mde
+
+- name: Copy script to target
+  ansible.windows.win_copy:
+    src: WindowsDefenderATPLocalOnboardingScript.cmd
+    dest: C:\Users\Public\Downloads\onboarding.cmd
+
+- name: run script
+  ansible.windows.win_command:
+    cmd: C:\Users\Public\Downloads\onboarding.cmd 

roles/windows_onboard-mde/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/windows_onboard-mde/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - windows_onboard-mde

roles/windows_onboard-mde/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for windows_onboard-mde