Bootstrapping Windows during automated deployments is one of the more frustrating aspects of working with templates that are being deployed by Infrastructure as Code toolsets. When I say bootstrapping, i’m talking about executing post deployment actions on templates such as configuring WinRM or setting Windows Firewall settings to allow for future operations after deployment.

VMware has offered functionality for a number of years via Guest Customizations, but the challenge I found was how to leverage that when deploying templates through Terraform plans. Specifically I needed to try and turn off the Windows Firewall on a Server Core after the cloning operation. There are a number of ways to turn off or set the Windows Firewall… but PowerShell provides the most elegant way to achieve this in a one liner as shown below:

set-NetFirewallProfile -All -Enabled False

The challenge is how to get Terraform to leverage Guest Customizations to execute during the initial template deployment and customization process of the plan apply. In a nutshell we can use the run_once_command_list option that is part of the VMware Tools Guest Customization rule set.

Basically we can list out one or multiple commands to be executed on the deployed Windows Server as shown below:


The working example I have above actually does a couple of things. Firstly we are running two PowerShell Invoke-WebRequest commands to go out and download scripts from GitHub and save them to the local drive. The next set of commands call PowerShell to run the scripts as part of the run_once_command_list. You can see that to make that happen we use auto_logon and auto_logon_count Guest Customization parameters. The actual PowerShell is executed via a cmd.exe command with the /C flag (Run Command and then terminate) and we also specify the ExecutionPolicy to bypass any account access controls.

Within that first.ps1 script is actually the command to disable the Windows Firewall. There is also a couple of other commands that I have to create a new user and add it to the local administrators account.

Wrap Up:

While this seems easy enough to show and explain, the reality for me, was to get to this point,  it has taken me a lot of trial and error and different approaches. With this solution I can now easily code in a list of PowerShell commands which Terraform will handle the execution of with Guest Customizations via the plan apply. It’s a pretty powerful way to get template deployments working out of the box during setup and deployment!

Full Example of the Terraform Declaration is below: