> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://support.workstatus.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Workstatus Windows Silent App Installation via MDM Using Ansible

# Workstatus Windows Silent App Installation via MDM Using Ansible

### 1. Overview
This document explains how to install the **Workstatus Silent App on Windows systems using MDM/Ansible**.
The installation is triggered from a **Linux-based Ansible server** and executed remotely on the target Windows client through **WinRM**.
###### Installation Flow
**Linux Ansible Server → WinRM → Windows Client → Workstatus Silent App**

### 2. Server System Configuration
The server system is the **Linux machine from which the Workstatus Silent App installation will be triggered**.
###### 2.1 Server System Requirements
The Linux server must have the following components installed:
* Ansible
* SSH
* Software Properties Common
The server should have network connectivity to the target Windows system.

###### 2.2 Install Ansible
Open the terminal on the Linux server and run the following commands:
* sudo apt update
* sudo apt install ssh -y
* sudo apt install software-properties-common -y
* sudo add-apt-repository --yes --update ppa:ansible/ansible
* sudo apt install ansible -y
###### **Verify Ansible Installation**
Run:
* ansible --version
**Expected Result**
If Ansible is installed successfully, the installed Ansible version will be displayed.
Example:
ansible [core ...]
python version = ...
jinja version = ...

###### 2.3. Enable SSH on the Server
SSH is required for server administration. The Ansible connection to the Windows client itself will use **WinRM**.
**Note:** This step is optional if SSH is already enabled on the Linux server.
**Start SSH Service :**
* sudo systemctl start ssh
**Enable SSH at Startup :**
* sudo systemctl enable ssh
**Check SSH Status :**
* sudo systemctl status ssh
**Expected Result**
The service status should show:
* Active: active (running)

###### 2.4. Verify Windows Client Connectivity
After configuring the inventory file, verify that Ansible can communicate with the Windows client.
Run:
* ansible -i inventory.ini 1XX.XXX.X.XX -m ansible.windows.win\_ping
Expected Successful Result:
1XX.XXX.X.XX | SUCCESS => {    "changed": false,
    "ping": "pong"}
If `"ping": "pong"` is returned, the Ansible server can successfully communicate with the Windows client.

Note : 1XX.XXX.X.XX is user system IP address
### 5. Windows User System Configuration
Complete the following configuration on the target Windows system.
###### 5.1 Set Windows Network Profile to Private
* Open **PowerShell as Administrator**.
* Check the current network profile: **Get-NetConnectionProfile**
* Check the value of: NetworkCategory : Public
* change it to: **Private** by using following command :
* Set-NetConnectionProfile -InterfaceIndex **<INDEX>** -NetworkCategory Private
Example: Set-NetConnectionProfile -InterfaceIndex **13** -NetworkCategory Private
###### **Verify**
* Run: Get-NetConnectionProfile
* The expected value is: **NetworkCategory : Private**
**Note :** Replace **<INDEX>**  with the InterfaceIndex number.

###### 5.2. Enable WinRM
WinRM is required for Ansible to communicate with the Windows client.
* Open **PowerShell or Command Prompt as Administrator** and run: **winrm quickconfig**
* If prompted, enter: Y
for the required confirmations.
WinRM should be configured and running successfully.

###### 5.3. Verify WinRM Listener
* Run: winrm enumerate winrm/config/listener
* Verify that the listener contains:
Transport = HTTP
Port = 5985
**Expected Configuration**
-Transport = HTTP
-Port = 5985
###### 
Port **5985** is the default WinRM HTTP port.

###### 5.4. Configure WinRM Authentication
Check the current WinRM authentication configuration:
* winrm get winrm/config/service/auth
Verify that:
* Basic = true
If Basic authentication is disabled, enable it from **PowerShell running as Administrator**:
* Set-Item -Path WSMan:\localhost\Service\Auth\Basic -Value $true
Then verify again:
* winrm get winrm/config/service/auth
The expected result is:
* Basic = true

###### 5.5. Verify Windows User Administrator Access
The Windows account used by Ansible must have administrator privileges.
Check the local user:
* Get-LocalUser
To check whether a particular user is a member of the Administrators group:
* Get-LocalGroupMember -Group Administrators
If required, add the user to the Administrators group:
* Add-LocalGroupMember -Group Administrators -Member ""
Example:
* Add-LocalGroupMember -Group Administrators -Member "workstatusadmin"
Verify:
* Get-LocalGroupMember -Group Administrators
The required user should appear in the list.

###### 5.6. Final WinRM Configuration Check
Run the following commands in **PowerShell as Administrator**:
* Set-Item -Path WSMan:\localhost\Service\Auth\Basic -Value $true
* Set-Item -Path WSMan:\localhost\Service\AllowUnencrypted -Value $true

### 6.Server System Action
###### 6.1.Configure Inventory File
Download the [Workstatus Silent App Installtion zip](https://app.workstatus.io/downloads/documents/windows/Windows_Silent_Ansible.zip) file provided for the Workstatus Silent App installation.
Extract zip file and open inventory file. The inventory file contains the details required to connect to the user's windows system.
**Open inventory.ini and enter:**
* **User system IP address**
* **ansible\_user**
* **ansible\_password**
* **System OS**
* **User workstatus email address**

For multiple Windows systems, copy the entry to a new line and update the IP address, username, password, and email for each user.
Example
1XX.1XX.X.XXX ansible\_user="system\_username" ansible\_password="system\_password" os=windows email=useremail@example .com
1XX.1XX.X.XXX ansible\_user="system\_username" ansible\_password="system\_password" os=windows email=useremail@example .com

**Note** : Replace the values with the actual user's details.


###### 6.2. Run the Installation
Open the terminal in the directory where inventory.ini and bash file stored and Run following command.
* source bash.sh
The script will use the information from inventory.ini to connect to the target Windows system and install the **Workstatus Silent App**.

### 7. Installation Validation
The MDM installation is considered successful when:
* Ansible successfully connects to the Windows client.
* The Workstatus Silent App installer executes successfully.
* Workstatus is installed on the Windows system.
* The Workstatus application starts successfully.
* The application connects to the Workstatus server.
* Tracking and configured activity features work correctly.