# Ansible 2.2.1.0 failing while connecting to Windows using AD credentials. **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [April 20, 2017, 11:00pm UTC](https://forum.ansible.com/t/ansible-2-2-1-0-failing-while-connecting-to-windows-using-ad-credentials/24273 "2017-04-20T23:00:14Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Siva\_Subramaniyan](https://avatars.discourse-cdn.com/v4/letter/s/ba8739/32.png) [@Siva\_Subramaniyan](https://forum.ansible.com/u/Siva_Subramaniyan)\ **Post date:** [April 20, 2017, 11:00pm UTC](https://forum.ansible.com/t/ansible-2-2-1-0-failing-while-connecting-to-windows-using-ad-credentials/24273/1 "2017-04-20T23:00:14Z")
[ConfigureRemotingForAnsible.ps1](https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1) ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [April 21, 2017, 1:08am UTC](https://forum.ansible.com/t/ansible-2-2-1-0-failing-while-connecting-to-windows-using-ad-credentials/24273/2 "2017-04-21T01:08:17Z")
Looks like you are on the right track where you can get a valid Kerberos ticket using kinit but your Ansible config needs a few more settings so it runs through Kerberos. Looking at the error message it is still trying to authenticate using Basic auth “plaintext” and not Kerberos. Also ansible\_ssh\_user has been deprecated in favour of ansible\_user which is probably why it doesn’t detect to use Kerberos. Try setting the following vars in your inventory [ansible\_user=ans...@UAT.INTRA.COM](mailto:ansible_user=ans...@UAT.INTRA.COM) ansible\_password=password here ansible\_port=5985 ansible\_connection=winrm ansible\_winrm\_transport=kerberos 3 things to say though when looking at your seting; - If you upgrade to Ansible 2.3 you don’t have to manually get a ticket beforehand using kinit, Ansible will do this for you which is a massive plus around automating this all - You can also use NTLM and CredSSP auth with domain accounts but Kerberos is definitely the most secure out of the 3 - You should be using HTTPS instead of HTTP as your messages and headers are in plaintext with HTTP which is a big no no in security. The ConfigureRemotingForAnsible.ps1 script will set up a HTTPS listener with a self signed cert for testing, You should use a proper cert if running this in production, my workplaces environment uses ADCS to set up a host certificate on each Windows box making it quite easy for us. Thanks Jordan ---
**Author:** ![Matt\_Davis](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Matt\_Davis](https://forum.ansible.com/u/Matt_Davis)\ **Post date:** [April 21, 2017, 1:15am UTC](https://forum.ansible.com/t/ansible-2-2-1-0-failing-while-connecting-to-windows-using-ad-credentials/24273/3 "2017-04-21T01:15:35Z")
Also, I think the EPEL packages for python kerberos and/or pywinrm may be horribly outdated (you’d think that working for Red Hat, I’d know who to bug about that, but alas…). That’s the likely cause of the error messages you’re seeing. Install via pip (as specified by the docs) to ensure you’ve got the latest. ---
**Author:** ![Siva\_Subramaniyan](https://avatars.discourse-cdn.com/v4/letter/s/ba8739/32.png) [@Siva\_Subramaniyan](https://forum.ansible.com/u/Siva_Subramaniyan)\ **Post date:** [April 21, 2017, 7:10pm UTC](https://forum.ansible.com/t/ansible-2-2-1-0-failing-while-connecting-to-windows-using-ad-credentials/24273/4 "2017-04-21T19:10:48Z")
**_Thank you so much Jordan and Matt._** Issue has been resolved now. I really appreciate your help on this, i was struggling to fix this for long time…!! Happy week end…! I just followed both of your steps to fix the issue:- Changed the hosts file as below:- [ansible\_user=ansible@UAT.INTRA.COM](mailto:ansible_user=ansible@UAT.INTRA.COM) ansible\_password=password ansible\_port=5986 ansible\_connection=winrm ansible\_winrm\_transport=kerberos ansible\_winrm\_server\_cert\_validation = ignore **after that updated the pywinrm[kerberos] :-** [root@liuatasans01 windows]# pip install pywinrm[kerberos] Requirement already satisfied: pywinrm[kerberos] in /usr/lib/python2.7/site-packages Requirement already satisfied: xmltodict in /usr/lib/python2.7/site-packages (from pywinrm[kerberos]) Requirement already satisfied: requests\>=2.9.1 in /usr/lib/python2.7/site-packages (from pywinrm[kerberos]) Requirement already satisfied: requests\_ntlm\>=0.3.0 in /usr/lib/python2.7/site-packages (from pywinrm[kerberos]) Requirement already satisfied: six in /usr/lib/python2.7/site-packages (from pywinrm[kerberos]) Collecting requests-kerberos\>=0.10.0 (from pywinrm[kerberos]) Downloading requests\_kerberos-0.11.0-py2.py3-none-any.whl Requirement already satisfied: python-ntlm3 in /usr/lib/python2.7/site-packages (from requests\_ntlm\>=0.3.0-\>pywinrm[kerberos]) Requirement already satisfied: pykerberos\<2.0.0,\>=1.1.8; sys\_platform != “win32” in /usr/lib64/python2.7/site-packages (from requests-kerberos\>=0.10.0-\>pywinrm[kerberos]) Installing collected packages: requests-kerberos Found existing installation: requests-kerberos 0.7.0 Uninstalling requests-kerberos-0.7.0: Successfully uninstalled requests-kerberos-0.7.0 **Successfully installed requests-kerberos-0.11.0** **[root@liuatasans01 ~]# ansible windows -m win\_ping 172.45.17.182 | SUCCESS =\> { "changed": false, "ping": "pong" }** Thanks Siva Subramaniyan ---
**Author:** ![Tom\_Paschenda](https://avatars.discourse-cdn.com/v4/letter/t/c0e974/32.png) [@Tom\_Paschenda](https://forum.ansible.com/u/Tom_Paschenda)\ **Post date:** [July 27, 2017, 5:58pm UTC](https://forum.ansible.com/t/ansible-2-2-1-0-failing-while-connecting-to-windows-using-ad-credentials/24273/5 "2017-07-27T17:58:22Z")
This helped me as well, thanks 🙂 ---
**Author:** ![Siva\_Subramaniyan](https://avatars.discourse-cdn.com/v4/letter/s/ba8739/32.png) [@Siva\_Subramaniyan](https://forum.ansible.com/u/Siva_Subramaniyan)\ **Post date:** [July 28, 2017, 1:50am UTC](https://forum.ansible.com/t/ansible-2-2-1-0-failing-while-connecting-to-windows-using-ad-credentials/24273/6 "2017-07-28T01:50:26Z")
Nice to Hear…!! Have a good one…!