Ansible 2.0.2 and Windows Server 2012

Archives Ansible Project
1

Hello, all.

Until today, I’d hadn’t used our recently updated Ansible (19.4. → 2.0.2) against our few Windows Server 2012R2 servers but, when I did, I had failures, even when running the simplest modules (e.g. win_ping). Here’s what I get:

Loaded callback minimal of type stdout, v2.0
ESTABLISH WINRM CONNECTION FOR USER: winuser on PORT 5986 TO veeambackup11
veeambackup11 | FAILED! => {
“failed”: true,
“msg”: “ssl: 500 WinRMTransport. [Errno 110] Connection timed out”
}

I see the “Connection timed out” message, but am puzzled as to why I’m getting it with Ansible version 2.0.2 (the Ansible upgrade is the only thing that’s changed in the environment). Everything worked on both Win2K8 and Win2k12 boxes in version 1.9.4. In version 2.0.2, everything works on the Win2k8 boxes but, as I said, not on Win2k12. Has anyone experienced, and solved, this problem, or can otherwise shed some light?

Many thanks.

2

I have hit a lot of s2012R2 machines today using ansible 2.0.0.2 and 2.0.2.0 so I don’t think it is something inherent in ansible.

Connection timed out implies it isn’t able to connect to winrm on the machine.

I suggest you try the pywinrm examples directly

https://github.com/diyan/pywinrm#run-process-with-low-level-api-with-domain-user-disabling-https-cert-validation

Also I’d go looking for firewall changes to make sure the winrm port is still open.

Hope this helps,

Jon

3

Thanks for the response, Jon.

As mentioned in my original post, version 1.9.4 worked with Win2k12 hosts just fine. It’s only after I upgraded to version 2.0.2 that things went bad. So, that had me looking at Ansible first.

Regarding pywinrm, I have version 0.1.1 installed and working. I believe that’s the correct version.

There have been no firewall changes. Even when I turn the firewall off, I get the same error.

4

Hi there,

2 things you can try. Add a group or host var ansible_winrm_server_cert_validation: ignore. Alternatively try out newer pywinrm: http://groups.google.com/group/ansible-project/t/bc497e9abbc592b6?utm_source=digest&utm_medium=email

With that you can use ansible_winrm_transport:ntlm or kerberos