# All works on port 5986, but fails on 5985

**URL:** <https://forum.ansible.com/t/all-works-on-port-5986-but-fails-on-5985/21533>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [May 24, 2016, 1:14am UTC](https://forum.ansible.com/t/all-works-on-port-5986-but-fails-on-5985/21533 "2016-05-24T01:14:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexander\_Fichel](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@Alexander\_Fichel](https://forum.ansible.com/u/Alexander_Fichel)\
**Post date:** [May 24, 2016, 1:14am UTC](https://forum.ansible.com/t/all-works-on-port-5986-but-fails-on-5985/21533/1 "2016-05-24T01:14:24Z")

</div>

What is the point of running the ConfigureRemotingForAnsible.ps1 script if I already have a listener on my windows:

Type Keys Name

* * *

Container {Transport=HTTP, Address=\*} Listener\_1084132640

Since script adds a HTTPS listener, I wanted to try and run Ansible playbook using non https port (5985)

I am using ansible 2.0.2.0

This works on port 5986 assuming I run the ConfigureRemotingForAnsible.ps1 script

ansible\_user: [my\_username@DOMAIN.COM](mailto:my_username@DOMAIN.COM)  
ansible\_port: 5986  
ansible\_connection: winrm  
ansible\_winrm\_server\_cert\_validation: ignore

But if I change to:

ansible\_user: [my\_username@DOMAIN.COM](mailto:my_username@DOMAIN.COM)  
ansible\_port: 5985  
ansible\_connection: winrm

I get error:

WinRMTransportError: 500 WinRMTransport. Kerberos-based authentication was failed. Code 500  
[n2-3wbn-udin41.na.msds.rhi.com](http://n2-3wbn-udin41.na.msds.rhi.com) | FAILED! =\> {  
“failed”: true,  
“msg”: "failed to exec cmd PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand U…

Does this mean my windows servers are not configured to be authenticated over HTTP?

---

<div class="post-metadata">

**Author:** ![Trond\_Hindenes](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@Trond\_Hindenes](https://forum.ansible.com/u/Trond_Hindenes)\
**Post date:** [May 24, 2016, 10:21am UTC](https://forum.ansible.com/t/all-works-on-port-5986-but-fails-on-5985/21533/2 "2016-05-24T10:21:59Z")

</div>

The Default WinRM (5985) listener uses Kerberos both for authentication and encryption (so commands aren’t sent in clear-text), it has a hard requirement on encryption (can be turned off, but not recommended). PyWinRM is not (at this time at least) able to do Kerberos-based encryption (as opposed to authentication), which is why we use ssl-based encryption instead (on port 5986).

This lets is do what we need securely, while not tearing holes in Windows’ default WinRM security.