Workstatus Windows Silent App Installation via MDM Using Ansible
Workstatus Windows Silent App Installation via MDM Using Ansible
1. Overview
This document explains how to install the Workstatus Silent App on Windows systems using MDM/Ansible.
The installation is triggered from a Linux-based Ansible server and executed remotely on the target Windows client through WinRM.
Installation Flow
Linux Ansible Server → WinRM → Windows Client → Workstatus Silent App
2. Server System Configuration
The server system is the Linux machine from which the Workstatus Silent App installation will be triggered.
2.1 Server System Requirements
The Linux server must have the following components installed:
- Ansible
- SSH
- Software Properties Common
The server should have network connectivity to the target Windows system.
2.2 Install Ansible
Open the terminal on the Linux server and run the following commands:
- sudo apt update
- sudo apt install ssh -y
- sudo apt install software-properties-common -y
- sudo add-apt-repository --yes --update ppa:ansible/ansible
- sudo apt install ansible -y
Verify Ansible Installation
Run:
- ansible --version
Expected Result
If Ansible is installed successfully, the installed Ansible version will be displayed.
Example:
ansible [core ...]
python version = ...
jinja version = ...
2.3. Enable SSH on the Server
SSH is required for server administration. The Ansible connection to the Windows client itself will use WinRM.
Note: This step is optional if SSH is already enabled on the Linux server.
Start SSH Service :
- sudo systemctl start ssh
Enable SSH at Startup :
- sudo systemctl enable ssh
Check SSH Status :
- sudo systemctl status ssh
Expected Result
The service status should show:
- Active: active (running)
2.4. Verify Windows Client Connectivity
After configuring the inventory file, verify that Ansible can communicate with the Windows client.
Run:
- ansible -i inventory.ini 1XX.XXX.X.XX -m ansible.windows.win_ping
Expected Successful Result:
1XX.XXX.X.XX | SUCCESS => { "changed": false,
"ping": "pong"}
If "ping": "pong" is returned, the Ansible server can successfully communicate with the Windows client.
Note : 1XX.XXX.X.XX is user system IP address
5. Windows User System Configuration
Complete the following configuration on the target Windows system.
5.1 Set Windows Network Profile to Private
- Open PowerShell as Administrator.
- Check the current network profile: Get-NetConnectionProfile
- Check the value of: NetworkCategory : Public
- change it to: Private by using following command :
- Set-NetConnectionProfile -InterfaceIndex **** -NetworkCategory Private
Example: Set-NetConnectionProfile -InterfaceIndex 13 -NetworkCategory Private
Verify
- Run: Get-NetConnectionProfile
- The expected value is: NetworkCategory : Private
Note : Replace **** with the InterfaceIndex number.
5.2. Enable WinRM
WinRM is required for Ansible to communicate with the Windows client.
- Open PowerShell or Command Prompt as Administrator and run: winrm quickconfig
- If prompted, enter: Y
for the required confirmations.
WinRM should be configured and running successfully.
5.3. Verify WinRM Listener
- Run: winrm enumerate winrm/config/listener
- Verify that the listener contains:
Transport = HTTP
Port = 5985
Expected Configuration
-Transport = HTTP
-Port = 5985
Port 5985 is the default WinRM HTTP port.
5.4. Configure WinRM Authentication
Check the current WinRM authentication configuration:
- winrm get winrm/config/service/auth
Verify that:
- Basic = true
If Basic authentication is disabled, enable it from PowerShell running as Administrator:
- Set-Item -Path WSMan:\localhost\Service\Auth\Basic -Value $true
Then verify again:
- winrm get winrm/config/service/auth
The expected result is:
- Basic = true
5.5. Verify Windows User Administrator Access
The Windows account used by Ansible must have administrator privileges.
Check the local user:
- Get-LocalUser
To check whether a particular user is a member of the Administrators group:
- Get-LocalGroupMember -Group Administrators
If required, add the user to the Administrators group:
- Add-LocalGroupMember -Group Administrators -Member ""
Example:
- Add-LocalGroupMember -Group Administrators -Member "workstatusadmin"
Verify:
- Get-LocalGroupMember -Group Administrators
The required user should appear in the list.
5.6. Final WinRM Configuration Check
Run the following commands in PowerShell as Administrator:
- Set-Item -Path WSMan:\localhost\Service\Auth\Basic -Value $true
- Set-Item -Path WSMan:\localhost\Service\AllowUnencrypted -Value $true
6.Server System Action
6.1.Configure Inventory File
Download the Workstatus Silent App Installtion zip file provided for the Workstatus Silent App installation.
Extract zip file and open inventory file. The inventory file contains the details required to connect to the user's windows system.
Open inventory.ini and enter:
- User system IP address
- ansible_user
- ansible_password
- System OS
- User workstatus email address
For multiple Windows systems, copy the entry to a new line and update the IP address, username, password, and email for each user.
Example
1XX.1XX.X.XXX ansible_user="system_username" ansible_password="system_password" os=windows email=useremail@example .com
1XX.1XX.X.XXX ansible_user="system_username" ansible_password="system_password" os=windows email=useremail@example .com
Note : Replace the values with the actual user's details.
6.2. Run the Installation
Open the terminal in the directory where inventory.ini and bash file stored and Run following command.
- source bash.sh
The script will use the information from inventory.ini to connect to the target Windows system and install the Workstatus Silent App.
7. Installation Validation
The MDM installation is considered successful when:
- Ansible successfully connects to the Windows client.
- The Workstatus Silent App installer executes successfully.
- Workstatus is installed on the Windows system.
- The Workstatus application starts successfully.
- The application connects to the Workstatus server.
- Tracking and configured activity features work correctly.
Updated on: 03/09/2026
Thank you!