diff --git a/provisioning/ansible/roles/configure_win10_client/tasks/install_ssh_server.yml b/provisioning/ansible/roles/configure_win10_client/tasks/install_ssh_server.yml
index 7dda600..8cdb936 100644
--- a/provisioning/ansible/roles/configure_win10_client/tasks/install_ssh_server.yml
+++ b/provisioning/ansible/roles/configure_win10_client/tasks/install_ssh_server.yml
@@ -23,17 +23,17 @@
 
 - name: SSH - Copy installation script
   win_template:
-    src: "{{ role_path }}/templates/install-openssh.ps1.j2"
+    src: "../templates/install-openssh.ps1.j2"
     dest: "C:\\install-openssh.ps1"
   when: not private_key.stat.exists
 
 - name: SSH - Run installation script
-  raw: "C:\\install-openssh.ps1"
+  win_shell: "C:\\install-openssh.ps1"
   when: not private_key.stat.exists
 
 - name: SSH - Deploy ssh server configuration
   win_template:
-    src: "{{ role_path }}/templates/sshd_config.j2"
+    src: "../templates/sshd_config.j2"
     dest: "{{ openssh_extract_dir }}\\{{ openssh_archive_name }}\\sshd_config"
   notify:
     - restart sshd
diff --git a/provisioning/ansible/roles/configure_win10_client/tasks/main.yml b/provisioning/ansible/roles/configure_win10_client/tasks/main.yml
index 8cb639c..679726e 100644
--- a/provisioning/ansible/roles/configure_win10_client/tasks/main.yml
+++ b/provisioning/ansible/roles/configure_win10_client/tasks/main.yml
@@ -1,4 +1,5 @@
 - include: setup_user.yml
+- include: set_timezone.yml
 - include: add_exclusion_folder.yml
 - include: disable_firewall.yml
 - include: disable_screen_lock.yml
diff --git a/provisioning/ansible/roles/configure_win10_client/tasks/set_timezone.yml b/provisioning/ansible/roles/configure_win10_client/tasks/set_timezone.yml
new file mode 100644
index 0000000..66d7197
--- /dev/null
+++ b/provisioning/ansible/roles/configure_win10_client/tasks/set_timezone.yml
@@ -0,0 +1,4 @@
+- name: Set time zone to CET and disable daylight saving time
+  community.windows.win_timezone:
+    timezone: Central European Standard Time_dstoff
+    # "_dstoff" disables daylight saving time
diff --git a/provisioning/packer/post_install/attacker_setup.sh b/provisioning/packer/post_install/attacker_setup.sh
index 1bffeeb..576f28c 100644
--- a/provisioning/packer/post_install/attacker_setup.sh
+++ b/provisioning/packer/post_install/attacker_setup.sh
@@ -3,11 +3,11 @@
 # Enable root account, set password and reboot
 touch /tmp/runasroot.sh
 
-echo "apt update" > /tmp/runasroot.sh
+echo "wget https://archive.kali.org/archive-key.asc -O /etc/apt/trusted.gpg.d/kali-archive-keyring.asc" > /tmp/runasroot.sh
+echo "apt update" >> /tmp/runasroot.sh
 echo "apt install kali-root-login" >> /tmp/runasroot.sh
 echo "echo 'root:breach' | chpasswd" >> /tmp/runasroot.sh
 echo "reboot" >> /tmp/runasroot.sh
 
 echo breach | sudo -S chmod +x /tmp/runasroot.sh
 echo breach | sudo -S /tmp/runasroot.sh
-
diff --git a/src/systests/test_attacks.py b/src/systests/test_attacks.py
index f5a2b71..6a80fdb 100644
--- a/src/systests/test_attacks.py
+++ b/src/systests/test_attacks.py
@@ -35,6 +35,9 @@
 from attacks.attack_set_autostart import SetAutostartAttack
 from attacks.attack_sqlmap import SQLMapAttack
 from attacks.attack_take_screenshot import TakeScreenshotAttack
+from attacks.attack_nmap_host_discovery import NmapHostDiscoveryAttack
+from attacks.attack_nmap_portscan import NmapPortscanAttack
+from attacks.attack_nmap_service_discovery import NmapServiceDiscoveryAttack
 from attacks.printer import ListPrinter, MultiPrinter
 from systests.helpers import try_until_counter_reached
 from vmcontrol.sessionhandler import SessionHandler
@@ -67,6 +70,9 @@ class TestAttack:
         FlashdriveExfiltrationAttack(),
         SetAutostartAttack(),
         SQLMapAttack(),
+        NmapHostDiscoveryAttack(),
+        NmapPortscanAttack(),
+        NmapServiceDiscoveryAttack(),
         # Meterpreter-based attacks: These attacks either infect a client with a reverse HTTP
         # payload (attack name starts with "infect_") or start a Meterpreter shell on such a
         # connection and run attack-specific commands (attack name starts with "c2_".