- name: Apply Windows Updates
  hosts: win_all
  gather_facts: yes
  vars:
    initial_reboot: |-
      {{ 86400 <
          (( ((ansible_date_time.date+" "+ansible_date_time.time)|to_datetime('%Y-%m-%d %H:%M:%S')) -
              ansible_facts.lastboot|to_datetime('%Y-%m-%d %H:%M:%SZ')).total_seconds())|abs }}
  tasks:
  - block:
    - name: Install Updates And Reboot
      ansible.windows.win_updates:
        category_names:
          - SecurityUpdates
          - CriticalUpdates
          - UpdateRollups
          - DefinitionUpdates
          - Updates
        reboot: false
        state: installed
      become: yes
      become_method: runas
      become_user: SYSTEM
      register: update_results

    - name: Reboot explicitly if required
      ansible.windows.win_reboot:
        reboot_timeout: 3600
        post_reboot_delay: 120
        test_command: 'powershell.exe -Command "Get-Service WinRM"'
      when: update_results.reboot_required