Ansible – Workstation Software Updating – Part 1

Apr 4, 2025

—

by

I’ve started learning Ansible again,

I used to PDQ to apply my workstations Software updates, but due to cost among with other factors I’ve shifted back towards Ansible for Automation.

My “First” Playbook is to install software updates on remote Workstations in my environment. which has taken me a bit, I tried to apply most of the updates using Chocolatey. which “worked” in some cases. but others where there were no update candidates available I’ve done direct download and install with arguments like /S and etc depending on the package.

First off, PDQ sets up restrictions on downloading updates automatically. we must remove that for the browsers we use. I found the following to work for each.

Edge Browsers

---
- name: Enable Edge Auto-Updates
  hosts: all
  tasks:
    - name: Remove registry setting to allow Edge updates
      win_shell: |
        Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge" -Name "Update" -Value $null -Force
        Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\EdgeUpdate" -Name "AutoUpdateCheckPeriodMinutes" -Value $null -Force
      register: result
      ignore_errors: true

    - name: Remove Edge Policies with Admin Privileges
      win_shell: |
        Start-Process powershell -ArgumentList 'Remove-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge" -Recurse -Force' -Verb RunAs

    - name: Enable Edge Auto-Update
      win_regedit:
        path: HKLM:\SOFTWARE\Policies\Microsoft\EdgeUpdate
        name: Update{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
        type: dword
        data: 1
        state: present

    - name: Ensure Edge updates are enabled
      win_service:
        name: "edgeupdate"
        state: started
        start_mode: auto

    - name: Force Group Policy update
      win_shell: gpupdate /force

Firefox Browsers

---
- name: Enable Firefox Auto-Updates
  hosts: all
  tasks:
    - name: Remove registry key for Mozilla Firefox DisableESR
      win_regedit:
        path: "HKLM:\\SOFTWARE\\Policies\\Mozilla"
        name: "DisableESR"
        state: absent

    - name: Remove registry key for Mozilla Firefox DisableAppUpdate
      win_regedit:
        path: "HKLM:\\SOFTWARE\\Policies\\Mozilla\\Firefox"
        name: "DisableAppUpdate"
        state: absent

    - name: Remove registry key for Mozilla Firefox BlockFirefoxUpdates
      win_regedit:
        path: "HKLM:\\SOFTWARE\\Policies\\Mozilla\\Firefox"
        name: "BlockFirefoxUpdates"
        state: absent

    - name: Remove registry key for Mozilla Firefox DisableAppUpdate in HKCU
      win_regedit:
        path: "HKCU:\\SOFTWARE\\Policies\\Mozilla\\Firefox"
        name: "DisableAppUpdate"
        state: absent

    - name: Remove registry key for Mozilla Firefox BlockFirefoxUpdates in HKCU
      win_regedit:
        path: "HKCU:\\SOFTWARE\\Policies\\Mozilla\\Firefox"
        name: "BlockFirefoxUpdates"
        state: absent

    - name: Allow updates in Firefox ESR policies.json
      win_copy:
        content: |
          {
            "policies": {
            "AppAutoUpdate": true,
            "DisableAppUpdate": false
            }
          }
        dest: 'C:\Program Files\Mozilla Firefox\distribution\policies.json'

Chrome Browsers

---
- name: Enable Chrome Auto-Updates
  hosts: all
  tasks:
    - name: Delete Chrome Update Registry Keys
      win_regedit:
        path: "HKLM:\\Software\\Policies\\Google\\Update"
        name: "{{ item }}"
        state: absent
      with_items:
        - UpdateDefault
        - AutoUpdateCheckPeriodMinutes
        - DisableAutoUpdateChecksCheckboxValue

    - name: Delete Entire Google Update Policy Key
      win_regedit:
        path: "HKLM:\\Software\\Policies\\Google\\Update"
        state: absent