# Ansible Kerberos Cannot contact any KDC for realm

**URL:** <https://forum.ansible.com/t/ansible-kerberos-cannot-contact-any-kdc-for-realm/29526>\
**Category:** Ansible Project\
**Created:** [January 25, 2019, 11:19am UTC](https://forum.ansible.com/t/ansible-kerberos-cannot-contact-any-kdc-for-realm/29526 "2019-01-25T11:19:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![sindhu\_shree](https://avatars.discourse-cdn.com/v4/letter/s/b5e925/32.png) [@sindhu\_shree](https://forum.ansible.com/u/sindhu_shree)\
**Post date:** [January 25, 2019, 11:19am UTC](https://forum.ansible.com/t/ansible-kerberos-cannot-contact-any-kdc-for-realm/29526/1 "2019-01-25T11:19:33Z")

</div>

Can anyone guide me why am getting this error ?

UNREACHABLE! =\> {  
“changed”: false,  
“msg”: “Kerberos auth failure: kinit: Cannot contact any KDC for realm ‘[AD.DOMAIN.COM](http://AD.DOMAIN.COM)’ while getting initial credentials”,  
“unreachable”: true  
}

My inventory and krb5.conf files looks like this

Hosts:

[win]  
[pc1.ad.domain.com](http://pc1.ad.domain.com)  
#10.217.25.246

[win:vars]  
[ansible\_user=user@AD.DOMAIN.COM](mailto:ansible_user=user@AD.DOMAIN.COM)  
ansible\_password=Welcome$123  
ansible\_connection= winrm  
ansible\_winrm\_transport= kerberos  
ansible\_winrm\_server\_cert\_validation=ignore

/etc/krb5.conf.d/ :

# Configuration snippets may be placed in this directory as well

includedir /etc/krb5.conf.d/

[logging]  
default = FILE:/var/log/krb5libs.log  
kdc = FILE:/var/log/krb5kdc.log  
admin\_server = FILE:/var/log/kadmind.log

[libdefaults]  
dns\_lookup\_realm = true  
ticket\_lifetime = 24h  
renew\_lifetime = 7d  
forwardable = true  
rdns = false  
dns\_lookup\_kdc = true  
pkinit\_anchors = /etc/pki/tls/certs/ca-bundle.crt  
default\_realm = [AD.DOMAIN.COM](http://AD.DOMAIN.COM)  
default\_ccache\_name = KEYRING:persistent:%{uid}

[realms]  
[AD.DOMAIN.COM](http://AD.DOMAIN.COM) = {  
kdc = [pc1.ad.domain.com](http://pc1.ad.domain.com)  
default\_server = [ad.infosys.com](http://ad.infosys.com)  
}

[domain\_realm]  
.ad.domain.com = [AD.DOMAIN.COM](http://AD.DOMAIN.COM)  
[ad.domain.com](http://ad.domain.com) = [AD.DOMAIN.COM](http://AD.DOMAIN.COM)