win_package uninstall example?

[Bob Tanner]

I'm trying to figure out how to use win_package to uninstall software. The state="absent" would do an uninstall?

It would seem this module can be used only for package installation?

[J Hawkesworth]

Yes adding

state: absent 

will uninstall the package.  Something like this:

    - name: remove java 8 if present

      win_package:

        name: "Java SE Development Kit 8 Update 73 (64-bit)"

        path: "c:\\packages\\jdk-8u73-windows-x64.exe"

        product_id: '{64A3A4F4-B792-11D6-A78A-00B0D0180730}'

        state: absent

        arguments: /s /L C:\logs\java8jdk-removal.log

[Bob Tanner]

Thank you for the example. 

I'm testing win_package to remove Silverlight and after 15 minutes of waiting Ansible has not returned.

Here is the task I'm using.

- name: remove packages (win_package)

  win_package: >

    name="Microsoft Silverlight"

    path="C:\\Program Files\\Microsoft Silverlight\\sllauncher.exe"

    product_id="{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}"

    state="absent"

Here is the relevant (-vvvv) output

TASK [windows-workstations : remove packages (win_package)] ********************

task path: /Users/tanner/projects/ansible.git/playbooks.git/roles/windows-workstations/tasks/main.yml:86

Using module file /Users/tanner/projects/ansible.git/ansible/lib/ansible/modules/extras/windows/win_package.ps1

<10.X.X.X> ESTABLISH WINRM CONNECTION FOR USER: Administrator on PORT 5986 TO 10.X.X.X

<10.X.X.X> EXEC Set-StrictMode -Version Latest

(New-Item -Type Directory -Path $env:temp -Name "ansible-tmp-1465501508.58-107879928529086").FullName | Write-Host -Separator '';

<10.X.X.X> PUT "/var/folders/y_/w_pbl7355vg3gv5xkmsld49m0000gn/T/tmpHf7TfN" TO "C:\Users\Administrator\AppData\Local\Temp\ansible-tmp-1465501508.58-107879928529086\win_package.ps1"

<10.X.X.X> EXEC Set-StrictMode -Version Latest

Try

{

& 'C:\Users\Administrator\AppData\Local\Temp\ansible-tmp-1465501508.58-107879928529086\win_package.ps1'

}

Catch

{

$_obj = @{ failed = $true }

If ($_.Exception.GetType)

{

$_obj.Add('msg', $_.Exception.Message)

}

Else

{

$_obj.Add('msg', $_.ToString())

}

If ($_.InvocationInfo.PositionMessage)

{

$_obj.Add('exception', $_.InvocationInfo.PositionMessage)

}

ElseIf ($_.ScriptStackTrace)

{

$_obj.Add('exception', $_.ScriptStackTrace)

}

Try

{

$_obj.Add('error_record', ($_ | ConvertTo-Json | ConvertFrom-Json))

}

Catch

{

}

Echo $_obj | ConvertTo-Json -Compress -Depth 99

Exit 1

}

Finally { Remove-Item "C:\Users\Administrator\AppData\Local\Temp\ansible-tmp-1465501508.58-107879928529086" -Force -Recurse -ErrorAction SilentlyContinue }

What can I do to troubleshoot this further?

[Bob Tanner]

And finally after 281m

Finally { Remove-Item "C:\Users\Administrator\AppData\Local\Temp\ansible-tmp-1465501508.58-107879928529086" -Force -Recurse -ErrorAction SilentlyContinue }

Traceback (most recent call last):

  File "/Users/tanner/projects/ansible.git/ansible/lib/ansible/plugins/connection/winrm.py", line 271, in exec_command

    result = self._winrm_exec(cmd_parts[0], cmd_parts[1:], from_exec=True)

  File "/Users/tanner/projects/ansible.git/ansible/lib/ansible/plugins/connection/winrm.py", line 217, in _winrm_exec

    response = Response(self.protocol.get_command_output(self.shell_id, command_id))

  File "/Users/tanner/projects/ansible.git/lib/python2.7/site-packages/winrm/protocol.py", line 333, in get_command_output

    self._raw_get_command_output(shell_id, command_id)

  File "/Users/tanner/projects/ansible.git/lib/python2.7/site-packages/winrm/protocol.py", line 352, in _raw_get_command_output

    res = self.send_message(xmltodict.unparse(req))

  File "/Users/tanner/projects/ansible.git/lib/python2.7/site-packages/winrm/protocol.py", line 207, in send_message

    return self.transport.send_message(message)

  File "/Users/tanner/projects/ansible.git/lib/python2.7/site-packages/winrm/transport.py", line 173, in send_message

    response = self.session.send(prepared_request, timeout=self.read_timeout_sec)

  File "/Users/tanner/projects/ansible.git/lib/python2.7/site-packages/requests/sessions.py", line 585, in send

    r = adapter.send(request, **kwargs)

  File "/Users/tanner/projects/ansible.git/lib/python2.7/site-packages/requests/adapters.py", line 479, in send

    raise ReadTimeout(e, request=request)

ReadTimeout: HTTPSConnectionPool(host='10.77.86.83', port=5986): Read timed out. (read timeout=30)

fatal: [win7-90day]: UNREACHABLE! => {"changed": false, "msg": "failed to exec cmd PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBUAHIAeQAKAHsACgAmACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADQANgA1ADUAMAAxADUAMAA4AC4ANQA4AC0AMQAwADcAOAA3ADkAOQAyADgANQAyADkAMAA4ADYAXAB3AGkAbgBfAHAAYQBjAGsAYQBnAGUALgBwAHMAMQAnAAoAfQAKAEMAYQB0AGMAaAAKAHsACgAkAF8AbwBiAGoAIAA9ACAAQAB7ACAAZgBhAGkAbABlAGQAIAA9ACAAJAB0AHIAdQBlACAAfQAKAEkAZgAgACgAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBHAGUAdABUAHkAcABlACkACgB7AAoAJABfAG8AYgBqAC4AQQBkAGQAKAAnAG0AcwBnACcALAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApAAoAfQAKAEUAbABzAGUACgB7AAoAJABfAG8AYgBqAC4AQQBkAGQAKAAnAG0AcwBnACcALAAgACQAXwAuAFQAbwBTAHQAcgBpAG4AZwAoACkAKQAKAH0ACgBJAGYAIAAoACQAXwAuAEkAbgB2AG8AYwBhAHQAaQBvAG4ASQBuAGYAbwAuAFAAbwBzAGkAdABpAG8AbgBNAGUAcwBzAGEAZwBlACkACgB7AAoAJABfAG8AYgBqAC4AQQBkAGQAKAAnAGUAeABjAGUAcAB0AGkAbwBuACcALAAgACQAXwAuAEkAbgB2AG8AYwBhAHQAaQBvAG4ASQBuAGYAbwAuAFAAbwBzAGkAdABpAG8AbgBNAGUAcwBzAGEAZwBlACkACgB9AAoARQBsAHMAZQBJAGYAIAAoACQAXwAuAFMAYwByAGkAcAB0AFMAdABhAGMAawBUAHIAYQBjAGUAKQAKAHsACgAkAF8AbwBiAGoALgBBAGQAZAAoACcAZQB4AGMAZQBwAHQAaQBvAG4AJwAsACAAJABfAC4AUwBjAHIAaQBwAHQAUwB0AGEAYwBrAFQAcgBhAGMAZQApAAoAfQAKAFQAcgB5AAoAewAKACQAXwBvAGIAagAuAEEAZABkACgAJwBlAHIAcgBvAHIAXwByAGUAYwBvAHIAZAAnACwAIAAoACQAXwAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApACkACgB9AAoAQwBhAHQAYwBoAAoAewAKAH0ACgBFAGMAaABvACAAJABfAG8AYgBqACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzACAALQBEAGUAcAB0AGgAIAA5ADkACgBFAHgAaQB0ACAAMQAKAH0ACgBGAGkAbgBhAGwAbAB5ACAAewAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAGkAcwB0AHIAYQB0AG8AcgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBuAHMAaQBiAGwAZQAtAHQAbQBwAC0AMQA0ADYANQA1ADAAMQA1ADAAOAAuADUAOAAtADEAMAA3ADgANwA5ADkAMgA4ADUAMgA5ADAAOAA2ACIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAH0A", "unreachable": true}

to retry, use: --limit @/Users/tanner/Downloads/ansible-retry/windows-workstations.retry

PLAY RECAP *********************************************************************

win7-90day                 : ok=2    changed=0    unreachable=1    failed=0

real 281m28.651s

user 3m28.843s

sys 2m12.636s

[J Hawkesworth]

My guess would be the (un)installer is hanging as its asking the user for info, which won't ever get supplied because there's no gui and eventually you hit a timeout or one of the winrm quota limits

You could try using raw to run msiexec with switches to write to a log file and see what info there is in the logs.

Also depending on the user you are running as, you may not have permissions to make changes to C:\Program Files\ - its more locked down in later versions of windows that it used to be long ago.  This may not apply if you are running as administrator, but you might need to turn off UAC prompting for Administrators, which you can do by tweaking the registry:

HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System
set
ConsentPromptBehaviorAdmin
to 0 to turn off and 5 to turn back on again (at least on s2012 R2)

Don't know if you have seen this but I put some tips for installing stuff on windows in my AnsibleFest London presentation which is available here:
http://www.slideshare.net/jhawkesworth/ansible-20-windows-and-no-powershell-this-year-i-promise-ansiblefest-london-2016

Hope this helps,

Jon

[Bob Tanner]

Very good info. Thank you!

Not sure this group or this thread is the right place to ask, but can you talk about Interactive services (slide 27) I do not understand why you would want to turn them off or on.

[Bob Tanner]

Uninstalling Windows packages via Ansible is hard.  Is this normal? I feeling like I'm missing something fundamental using Ansible to manage Windows.

Here's my playbook.

- name: disable UAC pop up for Administrators

   win_regedit:

    key: HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System

    value: ConsentPromptBehaviorAdmin

    data: 00000000

    datatype: dword

- name: remove packages (win_package)

  win_package: >

    name="Microsoft Silverlight"

    path="C:\\Program Files\\Microsoft Silverlight\\sllauncher.exe"

    product_id="{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}"

    state="absent"

The task hangs and eventually timeout.  Started to get desperate and added these plays:

      - name: disallow interactive services

        win_regedit:

            key: HKLM:\SYSTEM\CurrentControlSet\Control\Windows

            value: NoInteractiveServices

            data: 00000001

            datatype: dword

      - name: stop Interactive Services Detection

        win_service:

            name: 'UI0Detect'

            start_mode: manual

            state: stopped

Still the uninstall hangs and times out.

When I try uninstalling Silverlight via:

    msiexec /uninstall "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" /l C:\logs\zzz.log

I get the "Windows Installer" dialog prompting to confirm the uninstall. 

Click "Yes" and Silverlight is uninstalled. Nothing of much value in the C:\logs\zzz.log file.

    msiexec /uninstall "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" /l C:\logs\zzz.log \quiet

Uninstalls without any dialog. Nothing of much value in the logs.

How do I duplicate this uninstall with win_package?

I cannot seem to get win_msi to work either. 

I am brute forcing things with script :-(

- name: remove packages (powershell script)

  script: files/remove-package.ps1

remote-package.ps1

$app = Get-WmiObject -Class Win32_Product -Filter "IdentifyingNumber = '{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}'"

$app.Uninstall()

[J Hawkesworth]

Hi,

Although I've not tried uninstalling silverlight, I've certainly found some other things to be as difficult to uninstall as you seem to be above.
A lot of installers seem to have the assumption that there will be someone sitting there at a GUI answering questions.
I wound up using a brute force script to remove a particular version of java a little while back - the uninstallation just refused to work in a fully unattended manner (something that seems to have been fixed with the java 8 versions I've hit so far).

Generally though, unless its something very simple, newer stuff seems to be better at being installed and uninstalled in a fully unattended manner.  Its definitely worth poking suppliers about this too - fully automated install and uninstall is good for them to as they can automate their testing better after all.

You asked about interactive services.  I may have explained better during my talk - the audio is available here - https://www.ansible.com/ansible-2-windows - however the short version is long ago it was perfectly possible to write windows services which also interacted with the user via the system tray and by display forms.  Such interactive services ran on the first gui session that was started, known as the console session but this caused security vulnerabilities.  Its probably much better explained here: https://en.wikipedia.org/wiki/Shatter_attack - but more recent versions of windows have isolated the session which services run in from the sessions that ordinary interactive users log into, hence the need for Interactive Service Detection and the need to switch between the console session and user session so you can see the GUI of interactive services.  The most recent versions of windows default to not allowing Interactive Services (presumably the thinking is that enough time has passed now for apps to have been re-written so that the GUI components exist in a separate user space program which communicates with the service via the service message api).

Jon

[Trond Hindenes]

Disabling UAC will have no effect. Any session coming in thru WinRM is by default elevated.

As Jon writes, some packages are simply difficult/super-hard/impossible to uninstall in an unattended way. 

[Matt Davis]

Ansible's a pretty thin wrapper around the platform capabilities- installing/uninstalling software on Windows is tricky, as every installer is a special snowflake, and many assume that there's a user sitting there to answer dialogs.

That said, I know Sliverlight fully supports unattended install/uninstall- have a look at http://download.microsoft.com/download/7/8/d/78da8ec9-8801-42e5-89e5-3809386f1316/Silverlight%20Deployment%20Guide.doc

I suspect the switch you're looking for is "/qu" (silent uninstall).