diff --git a/roles/do1jlr.win_base_setup b/roles/do1jlr.win_base_setup
index 3026ccd..27cf9f9 160000
--- a/roles/do1jlr.win_base_setup
+++ b/roles/do1jlr.win_base_setup
@@ -1 +1 @@
-Subproject commit 3026ccda415fd94d3d2450c9409829537d2e2a14
+Subproject commit 27cf9f9b77e47ac7f14ac23961eafb09d4712df7
diff --git a/roles/win_warn_ansible_start/tasks/main.yml b/roles/win_warn_ansible_start/tasks/main.yml
new file mode 100644
index 0000000..7a25678
--- /dev/null
+++ b/roles/win_warn_ansible_start/tasks/main.yml
@@ -0,0 +1,10 @@
+---
+- name: Warn logged in users of impending upgrade
+  community.windows.win_msg:
+    display_seconds: 60
+    msg: Automated upgrade about to start.  Please save your work and log off immeditially
+
+- name: Ensure WinRM starts when the system has settled and is ready to work reliably
+  ansible.windows.win_service:
+    name: WinRM
+    start_mode: delayed
diff --git a/site.yml b/site.yml
index 5e134e7..25b378a 100644
--- a/site.yml
+++ b/site.yml
@@ -2,6 +2,7 @@
 - name: deploy windows users and basic config
   hosts: obs
   roles:
+    - {role: win_warn_ansible_start, tags: [always, warn]}
     - {role: do1jlr.win_base_setup, tags: [user, setup]}
     - {role: do1jlr.win_obs_setup, tags: [user, obs]}
     - {role: do1jlr.win_remove_win_apps, tags: cleanup}