# ansible 2.9.4 - task with delegate\_to: \<windows\_host\> works, subsequent tasks fail

**URL:** <https://forum.ansible.com/t/ansible-2-9-4-task-with-delegate-to-windows-host-works-subsequent-tasks-fail/33157>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [June 11, 2020, 5:36pm UTC](https://forum.ansible.com/t/ansible-2-9-4-task-with-delegate-to-windows-host-works-subsequent-tasks-fail/33157 "2020-06-11T17:36:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vampyreapocalypse](https://avatars.discourse-cdn.com/v4/letter/v/8e7dd6/32.png) [@vampyreapocalypse](https://forum.ansible.com/u/vampyreapocalypse)\
**Post date:** [June 11, 2020, 5:36pm UTC](https://forum.ansible.com/t/ansible-2-9-4-task-with-delegate-to-windows-host-works-subsequent-tasks-fail/33157/1 "2020-06-11T17:36:14Z")

</div>

Hi All, hope this question makes sense. Here goes:

Context: I have several automated patching playbooks that rely on stopping/starting services on windows before patching a database on Linux. We are using a python script to generate a dynamic inventory. We are leveraging a powershell script on a windows host to remotely start/stop services on various other windows hosts, so we only need to delegate to the one single windows host that houses the powershell scripts. We are NOT naming the windows host in the python script for dynamic inventory, and instead delegating to the FQDN of the windows host, backed by a host\_vars/\<windows\_server\>.yml for connection info for ansible to use. Oh and we are using psexec because I can’t get win\_shell to work to save my life.

Tasks:

**- name: Pre-patching - Copy powershell script to stop service (windows)**  
**run\_once: true**  
**become: false**  
**win\_copy:**  
**src: …/supporting\_tools/scripts/serviceshutdown{{ vmenv\_result.stdout }}**  
**dest: C:\temp\serviceshutdown{{ vmenv\_result.stdout }}.ps1**  
**force: no**  
**delegate\_to: windows\_server**

**- name: Pre-patching - Copy psexec to stop service (windows)**  
**run\_once: true**  
**become: false**  
**win\_copy:**  
**src: …/supporting\_tools/scripts/PsExec.exe**  
**dest: C:\temp\PsExec.exe**  
**force: no**

**delegate\_to: windows\_server**

**- name: Pre-patching - Stop service (windows)**  
**become: false**  
**run\_once: true**  
**win\_psexec:**  
**command: powershell.exe -executionpolicy bypass -noninteractive -nologo -file “C:\temp\serviceshutdown{{ vmenv\_result.stdout }}.ps1”**  
**executable: C:\temp\PsExec.exe**  
**elevated: yes**  
**nobanner: yes**  
**username: “{{ansible\_user}}”**  
**password: “{{ansible\_password}}”**  
**interactive: no**  
**vars:**  
**ansible\_become\_method: runas**

**delegate\_to: windows\_server**

host\_vars/windows\_server.yml:  
**ansible\_user: ad\_user**  
**ansible\_password: password**  
**ansible\_connection: winrm**  
**ansible\_winrm\_transport: ntlm**  
**ansible\_winrm\_server\_cert\_validation: ignore**

**ansible\_port: 5986**

---

<div class="post-metadata">

**Author:** ![racke](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/racke/32/4767_2.png) [@racke](https://forum.ansible.com/u/racke)\
**Post date:** [June 12, 2020, 6:56am UTC](https://forum.ansible.com/t/ansible-2-9-4-task-with-delegate-to-windows-host-works-subsequent-tasks-fail/33157/2 "2020-06-12T06:56:38Z")

</div>

> Hi All, hope this question makes sense. Here goes:
> 
> Context: I have several automated patching playbooks that rely on stopping/starting services on windows before patching  
> a database on Linux. We are using a python script to generate a dynamic inventory. We are leveraging a powershell script  
> on a windows host to remotely start/stop services on various other windows hosts, so we only need to delegate to the one  
> single windows host that houses the powershell scripts. We are NOT naming the windows host in the python script for  
> dynamic inventory, and instead delegating to the FQDN of the windows host, backed by a host\_vars/\<windows\_server\>.yml  
> for connection info for ansible to use. Oh and we are using psexec because I can't get win\_shell to work to save my life.
> 
> Tasks:  
> \*- name: Pre-patching - Copy powershell script to stop service (windows)\*  
> \* run\_once: true\*  
> \* become: false\*  
> \* win\_copy:\*  
> \* src: ../supporting\_tools/scripts/serviceshutdown{{ vmenv\_result.stdout }}\*  
> \* dest: C:\temp\serviceshutdown{{ vmenv\_result.stdout }}.ps1\*  
> \* force: no\*  
> \* delegate\_to: windows\_server\*  
> \*  
> \*  
> \*- name: Pre-patching - Copy psexec to stop service (windows)\*  
> \* run\_once: true\*  
> \* become: false\*  
> \* win\_copy:\*  
> \* src: ../supporting\_tools/scripts/PsExec.exe\*  
> \* dest: C:\temp\PsExec.exe\*  
> \* force: no\*  
> \* delegate\_to: windows\_server\*  
> \*  
> \*  
> \*- name: Pre-patching - Stop service (windows)\*  
> \* become: false\*  
> \* run\_once: true\*  
> \* win\_psexec:\*  
> \* command: powershell.exe -executionpolicy bypass -noninteractive -nologo -file "C:\temp\serviceshutdown{{  
> vmenv\_result.stdout }}.ps1"\*  
> \* executable: C:\temp\PsExec.exe\*  
> \* elevated: yes\*  
> \* nobanner: yes\*  
> \* username: "{{ansible\_user}}"\*  
> \* password: "{{ansible\_password}}"\*  
> \* interactive: no\*  
> \* vars:\*  
> \* ansible\_become\_method: runas\*  
> \* delegate\_to: windows\_server\*
> 
> host\_vars/windows\_server.yml:  
> \*ansible\_user: ad\_user  
> ansible\_password: password  
> ansible\_connection: winrm  
> ansible\_winrm\_transport: ntlm  
> ansible\_winrm\_server\_cert\_validation: ignore  
> \*  
> \*ansible\_port: 5986\*
> 
> --------------------  
> The above role tasks run fine. Services get stopped as expected and the playbook moves on. However the next role is to  
> gather the current repo information from the linux server that is to be patched and is a block that is a mix of  
> delegate\_to: 127.0.0.1 tasks and non delegated tasks (i.e.: they run on the target linux server). This is where the  
> playbook falls down and goes boom. The first non-delegated task after delegating to the windows server above fails with  
> the following error:
> 
> fatal: [linux\_server]: FAILED! =\> msg: The powershell shell family is incompatible with the sudo become plugin
> 
> The role in question is:
> 
> - name: Pre-patching - Update sw.repo block: - name: Pre-patching - gather minor OS target version shell: curl -sk -u  
> user:pass "[https://server.fqdn.com/cgi-bin/patchmm?major=\](https://server.fqdn.com/cgi-bin/patchmm?major=%5C){{ ansible\_distribution\_major\_version }}&os={{ os\_shorthand }}"  
> args: warn: false register: minor\_version changed\_when: false become: false delegate\_to: 127.0.0.1 - name: Pre-patching  
> - gather local errata repo name shell: yum repolist | grep ERRATA\_ | awk '{print $1}' register: current\_errata\_repo  
> args: warn: false changed\_when: false
> 
> when: ansible\_distribution != 'Debian' and ansible\_distribution != 'Ubuntu' and not (facter\_os.family == "RedHat" and  
> ansible\_distribution\_major\_version == "8")
> 
> The task in red is what is failing. I'm not sure why I'm getting this failure message since I'm not trying to use any  
> powershell commands or even target a windows server. I've tried putting ansible\_become\_method in the host\_vars file with  
> no difference in results. Using win\_shell to run a command to turn on or off a service seems to work, but I do not want  
> to have to target 8 or 9 windows servers individually (for this one application alone. there are others with more  
> servers behind them). Has anyone run across this before? What is the resolution here? Is it because I am not targeting  
> the windows host in inventory? I'd like to not do that because the entire playbook and all 50 or so included roles are  
> geared to linux only and I do not want to have to add when clauses everywhere.

Hello Andrew,

what are your connection settings for the linux\_server host?

Regards  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Racke

---

<div class="post-metadata">

**Author:** ![vampyreapocalypse](https://avatars.discourse-cdn.com/v4/letter/v/8e7dd6/32.png) [@vampyreapocalypse](https://forum.ansible.com/u/vampyreapocalypse)\
**Post date:** [June 15, 2020, 1:07pm UTC](https://forum.ansible.com/t/ansible-2-9-4-task-with-delegate-to-windows-host-works-subsequent-tasks-fail/33157/3 "2020-06-15T13:07:40Z")

</div>

@Racke,

These are my ansible.cfg settings. The playbook is called with ‘become: true’ since most tasks require elevated rights:

[defaults]  
forks = 60  
poll\_interval = 15  
become\_user = root  
remote\_port = 22  
host\_key\_checking = False  
become\_exe = sudo  
timeout = 60  
callback\_whitelist = timer, profile\_tasks  
display\_skipped\_hosts = no  
force\_color = True  
stdout\_callback = yaml  
bin\_ansible\_callbacks = True  
gather\_subset=!all,min,facter,!hardware,!network,!virtual,!ohai

[paramiko\_connection]  
record\_host\_keys = False  
host\_key\_checking = False

[ssh\_connection]  
ssh\_args = -o ControlMaster=no -o ControlPersist=60s -o ControlPath=/tmp/ssh-%h -o StrictHostKeyChecking=no  
scp\_if\_ssh = True  
retries = 2  
pipelining = True

---

<div class="post-metadata">

**Author:** ![vampyreapocalypse](https://avatars.discourse-cdn.com/v4/letter/v/8e7dd6/32.png) [@vampyreapocalypse](https://forum.ansible.com/u/vampyreapocalypse)\
**Post date:** [June 15, 2020, 7:29pm UTC](https://forum.ansible.com/t/ansible-2-9-4-task-with-delegate-to-windows-host-works-subsequent-tasks-fail/33157/4 "2020-06-15T19:29:10Z")

</div>

In hindsight this is pretty obvious – I did not realize I was stepping on some ansible built-ins like become\_method and whatnot. adding a set\_fact task after the windows execution solved this issue…